@gobing-ai/spur 0.3.55 → 0.3.57

package/spur.js

@@ -37430,7 +37430,10 @@ var init_finding_codes = __esm(() => {
     "L2.missing-required-section",
     "L2.forbidden-section",
     "L2.disallowed-section",
+    "L2.heading-level",
+    "L2.section-order",
     "L3.requirements-format",
+    "L3.requirements-checkbox",
     "L3.requirements-empty",
     "L3.ac-empty",
     "L3.ac-requirement-coverage",
@@ -37478,7 +37481,10 @@ var init_finding_codes = __esm(() => {
     L2_MISSING_REQUIRED_SECTION: "L2.missing-required-section",
     L2_FORBIDDEN_SECTION: "L2.forbidden-section",
     L2_DISALLOWED_SECTION: "L2.disallowed-section",
+    L2_HEADING_LEVEL: "L2.heading-level",
+    L2_SECTION_ORDER: "L2.section-order",
     L3_REQUIREMENTS_FORMAT: "L3.requirements-format",
+    L3_REQUIREMENTS_CHECKBOX: "L3.requirements-checkbox",
     L3_REQUIREMENTS_EMPTY: "L3.requirements-empty",
     L3_AC_EMPTY: "L3.ac-empty",
     L3_AC_REQUIREMENT_COVERAGE: "L3.ac-requirement-coverage",
@@ -50615,6 +50621,10 @@ async function countCheckpointsBySource(db2, source) {
   const row = await db2.queryFirst("SELECT COUNT(*) AS cnt FROM history_import_checkpoint WHERE source = ?", source);
   return row?.cnt ?? 0;
 }
+async function countToolCallsSince(db2, source, runStartedAt) {
+  const row = await db2.queryFirst("SELECT COUNT(*) AS cnt FROM history_tool_call WHERE source = ? AND imported_at >= ?", source, runStartedAt);
+  return row?.cnt ?? 0;
+}
 function withStepPredicates(wmWhere, predicates) {
   return wmWhere === "" ? `WHERE ${predicates}` : `${wmWhere} AND ${predicates}`;
 }
@@ -51040,7 +51050,7 @@ function renderBySession(artifact) {
   }
   for (const s of artifact.bySession) {
     const tokens = (s.tokens / 1e6).toFixed(1);
-    lines.push(`  ${s.sessionId.slice(0, 18).padEnd(18)} ` + `${s.source.slice(0, 8).padEnd(8)} ` + `${String(s.messages).padStart(5)} msg  ${String(s.toolCalls).padStart(5)} calls  ` + `${tokens.padStart(6)}M tok  $${s.costUsd.toFixed(2).padStart(7)}` + (s.topTool ? `  top: ${s.topTool}` : ""));
+    lines.push(`  ${s.sessionId.slice(0, 18).padEnd(18)} ` + `${s.source.slice(0, 8).padEnd(8)} ` + `${(s.startedAt ?? "\u2026").slice(0, 10).padStart(10)} ` + `${String(s.messages).padStart(5)} msg  ${String(s.toolCalls).padStart(5)} calls  ` + `${tokens.padStart(6)}M tok  $${s.costUsd.toFixed(2).padStart(7)}` + (s.topTool ? `  top: ${s.topTool}` : ""));
   }
   return lines;
 }
@@ -53764,6 +53774,9 @@ class TaskRunLinkDao {
     await this.db.run(`INSERT INTO task_run_links (id, wbs, run_id, kind, created_at)
              VALUES (?, ?, ?, ?, ?)`, [input.id, input.wbs, input.run_id, input.kind, input.created_at]);
   }
+  async updateRunId(id, runId) {
+    await this.db.run(`UPDATE task_run_links SET run_id = ?1 WHERE id = ?2`, runId, id);
+  }
   async listByWbs(wbs, limit) {
     try {
       return await this.db.queryAll(`SELECT id, wbs, run_id, kind, created_at
@@ -62114,7 +62127,8 @@ async function applyCliMigrations(adapter, migrations = CLI_MIGRATIONS) {
     const argsRawSkip = migration.id === "0012_spur_cli_history_tool_call_args_raw" && !await tableExists(adapter, "history_tool_call");
     const callIdSkip = migration.id === "0015_spur_cli_history_tool_call_call_id" && !await tableExists(adapter, "history_tool_call");
     const nameOccurredIndexSkip = migration.id === "0014_spur_cli_system_events_name_occurred_idx" && !await tableExists(adapter, "system_events");
-    if (shouldApplySql && !sequenceIndexSkip && !argsRawSkip && !nameOccurredIndexSkip && !callIdSkip && !tsNullableSkip) {
+    const runsStatusDoneSkip = migration.id === "0017_spur_cli_runs_status_completed_to_done" && (!await tableExists(adapter, "runs") || !await columnExists(adapter, "runs", "status"));
+    if (shouldApplySql && !sequenceIndexSkip && !argsRawSkip && !runsStatusDoneSkip && !nameOccurredIndexSkip && !callIdSkip && !tsNullableSkip) {
       for (const statement of splitSqlStatements(migration.sql)) {
         await adapter.exec(statement);
       }
@@ -62369,6 +62383,10 @@ ${HISTORY_RUN_SESSION_SCHEMA_SQL}
     {
       id: "0016_spur_cli_history_message_ts_nullable",
       sql: HISTORY_MESSAGE_TS_NULLABLE_SCHEMA_SQL
+    },
+    {
+      id: "0017_spur_cli_runs_status_completed_to_done",
+      sql: "UPDATE runs SET status = 'done' WHERE status = 'completed'"
     }
   ];
 });
@@ -64266,8 +64284,8 @@ var init_markdown_document = __esm(() => {
     "Q&A",
     "Design",
     "Plan",
-    "Solution",
     "Root Cause",
+    "Solution",
     "Testing",
     "Review",
     "References",
@@ -64599,6 +64617,62 @@ var init_task_skeleton = __esm(() => {
   CANONICAL_INDEX = new Map(TASK_CANONICAL_SECTIONS.map((s2, i2) => [s2, i2]));
 });
 
+// ../../packages/domain/src/retention.ts
+import { readdirSync as readdirSync5, rmSync as rmSync3, statSync as statSync6 } from "fs";
+import { join as join7 } from "path";
+async function runRetention(db2, cwd, now = new Date) {
+  const result = { ruleEvalRuns: 0, queueJobs: 0, ledgerRows: 0, backupFiles: 0 };
+  result.ruleEvalRuns = await purgeRuleEvalRuns(db2, now);
+  result.queueJobs = await purgeQueueJobs(db2, now);
+  result.ledgerRows = await purgeLedger(db2, now);
+  result.backupFiles = pruneBackups(cwd, now);
+  return result;
+}
+async function purgeRuleEvalRuns(db2, now) {
+  return purgeRows(db2, `DELETE FROM rule_eval_runs WHERE created_at < ?`, new Date(now.getTime() - RULE_EVAL_RUN_RETENTION_DAYS * DAY_MS).toISOString());
+}
+async function purgeQueueJobs(db2, now) {
+  return purgeRows(db2, `DELETE FROM queue_jobs WHERE status IN ('completed', 'failed') AND updated_at < ?`, now.getTime() - QUEUE_JOB_RETENTION_DAYS * DAY_MS);
+}
+async function purgeLedger(db2, now) {
+  return purgeRows(db2, `DELETE FROM history_import_ledger WHERE imported_at < ?`, new Date(now.getTime() - LEDGER_RETENTION_DAYS * DAY_MS).toISOString());
+}
+function pruneBackups(cwd, now) {
+  const dir = join7(cwd, ".spur", "backups");
+  let entries;
+  try {
+    entries = readdirSync5(dir);
+  } catch {
+    return 0;
+  }
+  const cutoffMs = now.getTime() - BACKUP_RETENTION_DAYS * DAY_MS;
+  let reclaimed = 0;
+  for (const name of entries) {
+    const path9 = join7(dir, name);
+    try {
+      const stat = statSync6(path9);
+      if (!stat.isFile() || stat.mtimeMs >= cutoffMs)
+        continue;
+      rmSync3(path9, { force: true });
+      reclaimed += 1;
+    } catch {}
+  }
+  return reclaimed;
+}
+async function purgeRows(db2, sql4, cutoff) {
+  try {
+    await db2.run(sql4, cutoff);
+    const row = await db2.queryFirst("SELECT changes() AS n");
+    return row?.n ?? 0;
+  } catch {
+    return 0;
+  }
+}
+var RULE_EVAL_RUN_RETENTION_DAYS = 90, QUEUE_JOB_RETENTION_DAYS = 30, LEDGER_RETENTION_DAYS = 180, BACKUP_RETENTION_DAYS = 30, DAY_MS;
+var init_retention = __esm(() => {
+  DAY_MS = 24 * 60 * 60 * 1000;
+});
+
 // ../../packages/domain/src/stage-registry/validator.ts
 function generateRunId() {
   const crypto3 = globalThis.crypto;
@@ -64881,6 +64955,7 @@ __export(exports_src, {
   selectorDigest: () => selectorDigest,
   sectionMatrixSchema: () => sectionMatrixSchema,
   scaffoldFeatureScenarios: () => scaffoldFeatureScenarios,
+  runRetention: () => runRetention,
   roleTokenSummary: () => roleTokenSummary,
   resolveReportMode: () => resolveReportMode,
   resolvePricing: () => resolvePricing,
@@ -64963,6 +65038,7 @@ __export(exports_src, {
   createId: () => createId,
   createDefaultRegistry: () => createDefaultRegistry,
   createBoundaryContext: () => createBoundaryContext,
+  countToolCallsSince: () => countToolCallsSince,
   countCheckpointsBySource: () => countCheckpointsBySource,
   computeSnapshotHash: () => computeSnapshotHash,
   computeRecordCost: () => computeRecordCost,
@@ -65086,6 +65162,7 @@ var init_src2 = __esm(() => {
   init_rebuild_events();
   init_schema6();
   init_task_skeleton();
+  init_retention();
   init_stage_registry();
 });
 
@@ -65601,7 +65678,7 @@ var isAgentExecution = (e) => ("executionId" in e), isActionOutput = (e) => ("st
 
 // ../../packages/app/src/observability/workflow-run-log-sink.ts
 import { closeSync as closeSync2, mkdirSync as mkdirSync5, openSync as openSync2, writeSync as writeSync2 } from "fs";
-import { join as join7 } from "path";
+import { join as join8 } from "path";
 
 class WorkflowRunLogSink {
   filePath;
@@ -65617,7 +65694,7 @@ class WorkflowRunLogSink {
   bus;
   handlers;
   constructor(options) {
-    this.filePath = join7(options.dir, `${options.runId}.log`);
+    this.filePath = join8(options.dir, `${options.runId}.log`);
     this.maxBytes = options.maxBytes ?? DEFAULT_RUN_LOG_MAX_BYTES;
     this.maxLines = options.maxLines;
     this.planPreview = options.planPreview;
@@ -66128,7 +66205,24 @@ class AgentService {
   async doctor(args, deps) {
     const executors = this.ctx.agentConfig?.executors;
     const doctorRunner = deps?.doctorRunner ?? new DoctorRunner({ env: this.ctx.env, executors });
-    const results = args.agent === undefined ? await doctorRunner.runAll() : [await doctorRunner.runOne(args.agent)];
+    if (args.agent === undefined) {
+      const results2 = await doctorRunner.runAll();
+      return this.renderDoctor(results2, executors, args.json, args.agent);
+    }
+    const roleDef = this.ctx.roles?.get(args.agent);
+    if (roleDef !== undefined) {
+      const resolved = await this.resolveRole(args.agent, roleDef.tier, doctorRunner);
+      if (!resolved.ok) {
+        this.ctx.output.error(resolved.message);
+        return resolved.exitCode;
+      }
+      const results2 = [await doctorRunner.runOne(resolved.executor ?? resolved.agent)];
+      return this.renderDoctor(results2, executors, args.json, resolved.executor ?? resolved.agent);
+    }
+    const results = [await doctorRunner.runOne(args.agent)];
+    return this.renderDoctor(results, executors, args.json, args.agent);
+  }
+  renderDoctor(results, executors, json3, agent) {
     const modelByExecutor = new Map((executors ?? []).filter((e) => e.model !== undefined).map((e) => [e.name, e.model]));
     for (const result of results) {
       if (result.modelStatus && (result.modelStatus.status === "quota_exhausted" || result.modelStatus.status === "unavailable")) {
@@ -66136,14 +66230,14 @@ class AgentService {
         this.ctx.output.error(`Warning: executor ${result.agent} (model ${model}) reports ${result.modelStatus.status}. Consider \`--agent <alt>\` or check token quota.`);
       }
     }
-    if (args.json) {
+    if (json3) {
       const executorByName = new Map((executors ?? []).map((e) => [e.name, e]));
       const rows = results.map((result) => {
         const executor = executorByName.get(result.agent) ?? { name: result.agent, agent: result.agent };
         return { ...result, capabilityTier: getExecutorTier(executor) };
       });
       this.ctx.output.write(toJson({ agents: rows }));
-    } else if (args.agent !== undefined) {
+    } else if (agent !== undefined) {
       this.ctx.output.write(renderDoctorDetail(results[0] ?? null));
     } else {
       this.ctx.output.write(renderDoctorTable(results));
@@ -67092,7 +67186,6 @@ function renderDoctorTable(results) {
       state: usable ? "usable" : "missing",
       agent: result.agent,
       tier: String(result.tier),
-      auth: usable ? renderAuth(result.authenticated) : dash,
       version: result.version ?? dash,
       model: renderModelStatus(result.modelStatus)
     };
@@ -67102,7 +67195,6 @@ function renderDoctorTable(results) {
     state: "STATUS",
     agent: "AGENT",
     tier: "TIER",
-    auth: "AUTH",
     version: "VERSION",
     model: "MODEL"
   };
@@ -67111,9 +67203,8 @@ function renderDoctorTable(results) {
   const wState = width("state");
   const wAgent = width("agent");
   const wTier = width("tier");
-  const wAuth = width("auth");
   const wVersion = width("version");
-  const line = (row) => `${row.glyph} ${row.state.padEnd(wState)}  ${row.agent.padEnd(wAgent)}  ${row.tier.padEnd(wTier)}  ${row.auth.padEnd(wAuth)}  ${row.version.padEnd(wVersion)}  ${row.model}`.trimEnd();
+  const line = (row) => `${row.glyph} ${row.state.padEnd(wState)}  ${row.agent.padEnd(wAgent)}  ${row.tier.padEnd(wTier)}  ${row.version.padEnd(wVersion)}  ${row.model}`.trimEnd();
   const usableCount = rows.filter((row) => row.state === "usable").length;
   const missingTier1 = results.filter((result) => !result.usable && result.tier === 1).length;
   const footer = missingTier1 > 0 ? `${usableCount} usable, ${missingTier1} missing (tier-1)` : `${usableCount} usable, ${rows.length - usableCount} missing`;
@@ -67239,7 +67330,7 @@ var init_agent_service = __esm(() => {
 });
 
 // ../../packages/app/src/services/anchor-qualifier.ts
-import { basename as basename2, join as join8 } from "path";
+import { basename as basename2, join as join9 } from "path";
 async function resolveRepoRoot(projectRoot) {
   if (projectRoot)
     return projectRoot;
@@ -67365,7 +67456,7 @@ async function qualifyAnchors(fs3, opts) {
     } catch {
       continue;
     }
-    const mdFiles = entries.filter((name) => name.endsWith(".md") && name !== "kanban.md").map((name) => join8(dir, name)).sort();
+    const mdFiles = entries.filter((name) => name.endsWith(".md") && name !== "kanban.md").map((name) => join9(dir, name)).sort();
     for (const filePath of mdFiles) {
       let raw;
       try {
@@ -67690,6 +67781,249 @@ var init_finding_codes2 = __esm(() => {
   init_src();
 });
 
+// ../../packages/app/src/services/structural-repair.ts
+function canonicalOrder(domain2) {
+  return domain2 === "task" ? TASK_CANONICAL_SECTIONS : FEATURE_CANONICAL_SECTIONS;
+}
+function splitFrontmatter(content) {
+  const m = FM_RE.exec(content);
+  if (m && m.index === 0) {
+    return { frontmatter: m[0], body: content.slice(m[0].length) };
+  }
+  return { frontmatter: "", body: content };
+}
+function scanHeadings(body, level) {
+  const headings = [];
+  let inCodeBlock = false;
+  let lineStart = 0;
+  for (let i2 = 0;i2 <= body.length; i2++) {
+    const atEnd = i2 === body.length;
+    if (!atEnd && body[i2] !== `
+`)
+      continue;
+    const line = body.slice(lineStart, i2);
+    if (line.startsWith("```")) {
+      inCodeBlock = !inCodeBlock;
+    } else {
+      const m = /^(#{1,6}) (.+)$/.exec(line);
+      if (m !== null && !inCodeBlock) {
+        const hashes = (m[1] ?? "").length;
+        headings.push({
+          start: lineStart,
+          line,
+          hashes,
+          name: (m[2] ?? "").trim(),
+          atLevel: hashes === level
+        });
+      }
+    }
+    lineStart = i2 + 1;
+  }
+  return headings;
+}
+function requirementsMissingCheckbox(body) {
+  const out = [];
+  for (const [i2, line] of body.split(`
+`).entries()) {
+    if (/\[[ xX]\]/.test(line))
+      continue;
+    const m = /^(\s*)([-*])?\s*R\d+\.?(\s.*)?$/.exec(line);
+    if (m !== null)
+      out.push({ index: i2, bullet: m[2] ?? "" });
+  }
+  return out;
+}
+function correctedHeadings(headings, level, canonical) {
+  return headings.map((h2) => h2.atLevel || !canonical.has(h2.name) ? h2 : { start: h2.start, line: h2.line, hashes: level, name: h2.name, atLevel: true });
+}
+function structuralFindings(content, domain2) {
+  const findings = [];
+  const level = LEVEL[domain2];
+  const order = canonicalOrder(domain2);
+  const { body } = splitFrontmatter(content);
+  const headings = scanHeadings(body, level);
+  const canonical = new Set(order);
+  for (const h2 of headings) {
+    if (h2.atLevel || !canonical.has(h2.name))
+      continue;
+    findings.push({
+      layer: "L2",
+      code: FINDING_CODES.L2_HEADING_LEVEL,
+      severity: "warning",
+      section: h2.name,
+      message: `Section "${h2.name}" uses ${h2.hashes} heading level; expected ${level} (${"#".repeat(level)} ${h2.name})`
+    });
+  }
+  const corrected = correctedHeadings(headings, level, canonical);
+  const atLevel = corrected.filter((h2) => h2.atLevel);
+  const presentCanonical = atLevel.filter((h2) => canonical.has(h2.name));
+  const allCanonical = atLevel.length === presentCanonical.length;
+  const ranked = presentCanonical.map((h2) => order.indexOf(h2.name));
+  const sorted = [...ranked].sort((a2, b) => a2 - b);
+  const outOfOrder = ranked.some((r, i2) => r !== (sorted[i2] ?? -1));
+  if (allCanonical && outOfOrder && presentCanonical.length > 1) {
+    findings.push({
+      layer: "L2",
+      code: FINDING_CODES.L2_SECTION_ORDER,
+      severity: "warning",
+      section: "",
+      message: `Sections are out of canonical order: ${presentCanonical.map((h2) => h2.name).join(" \u2192 ")} (expected ${order.join(" \u2192 ")})`
+    });
+  }
+  const reqHeading = atLevel.find((h2) => h2.name === "Requirements");
+  if (reqHeading !== undefined) {
+    const bodyStart = reqHeading.start + reqHeading.line.length + 1;
+    const next = atLevel.find((h2) => h2.start > reqHeading.start);
+    const bodyEnd = next !== undefined ? next.start : body.length;
+    const missing = requirementsMissingCheckbox(body.slice(bodyStart, bodyEnd));
+    if (missing.length > 0) {
+      findings.push({
+        layer: "L3",
+        code: FINDING_CODES.L3_REQUIREMENTS_CHECKBOX,
+        severity: "warning",
+        section: "Requirements",
+        message: `${missing.length} R-item(s) missing the checkbox marker \u2014 write as "- [ ] R1. \u2026"`
+      });
+    }
+  }
+  return findings;
+}
+function applyStructuralRepairs(content, domain2, entry) {
+  const repairs = [];
+  const level = LEVEL[domain2];
+  const order = canonicalOrder(domain2);
+  const canonical = new Set(order);
+  const { frontmatter, body } = splitFrontmatter(content);
+  const headings = scanHeadings(body, level);
+  const levelEdits = new Map;
+  for (const h2 of headings) {
+    if (h2.atLevel || !canonical.has(h2.name))
+      continue;
+    const fixed = `${"#".repeat(level)} ${h2.name}`;
+    levelEdits.set(h2.start, fixed);
+    repairs.push({
+      kind: "heading-level",
+      section: h2.name,
+      detail: `"${h2.line.trim()}" \u2192 "${fixed.trim()}"`
+    });
+  }
+  const corrected = correctedHeadings(headings, level, canonical);
+  const atLevel = corrected.filter((h2) => h2.atLevel);
+  const leadStart = atLevel.length > 0 ? atLevel[0]?.start ?? 0 : body.length;
+  const lead = body.slice(0, leadStart);
+  const blocks = [];
+  for (let i2 = 0;i2 < atLevel.length; i2++) {
+    const h2 = atLevel[i2];
+    if (h2 === undefined)
+      continue;
+    const next = atLevel[i2 + 1];
+    const end = next !== undefined ? next.start : body.length;
+    const headingLine = levelEdits.get(h2.start) ?? h2.line;
+    const bodyStart = h2.start + h2.line.length + 1;
+    blocks.push({
+      name: h2.name,
+      heading: headingLine,
+      body: body.slice(bodyStart, end),
+      canonicalRank: order.indexOf(h2.name)
+    });
+  }
+  const present = new Set(blocks.map((b) => b.name));
+  const missingNames = (entry?.required ?? []).filter((n2) => !present.has(n2) && canonical.has(n2)).sort((a2, b) => order.indexOf(a2) - order.indexOf(b));
+  for (const name of missingNames) {
+    repairs.push({
+      kind: "missing-section",
+      section: name,
+      detail: `inserted empty "${"#".repeat(level)} ${name}"`
+    });
+  }
+  const presentCanonical = blocks.filter((b) => b.canonicalRank >= 0);
+  const allCanonical = blocks.length === presentCanonical.length;
+  const ranked = presentCanonical.map((b) => b.canonicalRank);
+  const sortedRanks = [...ranked].sort((a2, b) => a2 - b);
+  const outOfOrder = ranked.some((r, i2) => r !== (sortedRanks[i2] ?? -1));
+  const reorder = allCanonical && outOfOrder && presentCanonical.length > 1;
+  if (reorder) {
+    repairs.push({
+      kind: "section-order",
+      section: "",
+      detail: `reordered to ${[...presentCanonical].sort((a2, b) => a2.canonicalRank - b.canonicalRank).map((b) => b.name).join(" \u2192 ")}`
+    });
+  }
+  const reqBlock = blocks.find((b) => b.name === "Requirements");
+  let reqRepairs = [];
+  if (reqBlock !== undefined) {
+    reqRepairs = requirementsMissingCheckbox(reqBlock.body);
+    if (reqRepairs.length > 0) {
+      repairs.push({
+        kind: "requirement-checkbox",
+        section: "Requirements",
+        detail: `${reqRepairs.length} R-item(s) gained the "[ ] " checkbox marker`
+      });
+    }
+  }
+  if (repairs.length === 0) {
+    return { content, changed: false, repairs: [] };
+  }
+  const orderedBlocks = reorder ? [...presentCanonical].sort((a2, b) => a2.canonicalRank - b.canonicalRank) : blocks;
+  const emitted = new Set;
+  const rendered = [];
+  for (const b of orderedBlocks) {
+    emitted.add(b.name);
+    let blockBody = b.body;
+    if (b.name === "Requirements" && reqRepairs.length > 0) {
+      const lines = blockBody.split(`
+`);
+      for (const rr of reqRepairs) {
+        const orig = lines[rr.index];
+        if (orig === undefined)
+          continue;
+        const leadWs = /^(\s*)/.exec(orig)?.[1] ?? "";
+        const rest = orig.slice(leadWs.length).replace(/^[-*]\s*/, "");
+        lines[rr.index] = `${leadWs}${rr.bullet === "" ? "- [ ]" : `${rr.bullet} [ ]`} ${rest}`;
+      }
+      blockBody = lines.join(`
+`);
+    }
+    rendered.push(`${b.heading}
+${blockBody}`);
+  }
+  for (const b of blocks) {
+    if (!emitted.has(b.name)) {
+      rendered.push(`${b.heading}
+${b.body}`);
+    }
+  }
+  if (missingNames.length > 0) {
+    for (const name of missingNames) {
+      const rank = order.indexOf(name);
+      const at = rendered.findIndex((blk) => {
+        const headingName = /^#{1,6} (.+)$/.exec(blk.split(`
+`)[0] ?? "")?.[1]?.trim() ?? "";
+        return canonical.has(headingName) && order.indexOf(headingName) > rank;
+      });
+      const heading = `${"#".repeat(level)} ${name}
+`;
+      const prev = at === -1 ? rendered[rendered.length - 1] : rendered[at - 1];
+      const sep = prev !== undefined && !prev.endsWith(`
+
+`) ? `
+` : "";
+      rendered.splice(at === -1 ? rendered.length : at, 0, `${sep}${heading}
+`);
+    }
+  }
+  const result = frontmatter + lead + rendered.join("");
+  const changed = result !== content;
+  return { content: result, changed, repairs };
+}
+var LEVEL, FM_RE;
+var init_structural_repair = __esm(() => {
+  init_src2();
+  init_planning_check_base();
+  LEVEL = { task: 3, feature: 2 };
+  FM_RE = /^---\r?\n[\s\S]*?\r?\n---\r?\n?/;
+});
+
 // ../../packages/app/src/services/planning-check-base.ts
 function key(e) {
   return `${e.kind}:${e.id}:${e.code}`;
@@ -67741,7 +68075,7 @@ class PlanningCheckService {
     }
     return doc2;
   }
-  runL2(doc2, entry, findings) {
+  runL2(doc2, entry, findings, raw) {
     if (!entry)
       return;
     const sectionNames = doc2.sectionNames;
@@ -67786,6 +68120,7 @@ class PlanningCheckService {
         });
       }
     }
+    findings.push(...structuralFindings(raw, this.docKind));
   }
   summarizeWithStatus(status, findings, strict, overrides, accepted, id) {
     const effectiveFindings = [];
@@ -67830,6 +68165,7 @@ class PlanningCheckService {
 var init_planning_check_base = __esm(() => {
   init_src2();
   init_finding_codes2();
+  init_structural_repair();
 });
 
 // ../../packages/app/src/services/feature-check.ts
@@ -67841,7 +68177,7 @@ __export(exports_feature_check, {
   FeatureCheckService: () => FeatureCheckService,
   DEFAULT_FEATURE_MATRIX: () => DEFAULT_FEATURE_MATRIX
 });
-import { dirname as dirname8, join as join9 } from "path";
+import { dirname as dirname8, join as join10 } from "path";
 function isGroupFeature(fm) {
   const tags = fm.tags;
   return Array.isArray(tags) && tags.includes("group") ? "group" : "standard";
@@ -67939,9 +68275,9 @@ function decodeVerdictRows(source, sectionName, required2) {
 function defaultVerdictRunDir(tasksDir) {
   const norm = tasksDir.replace(/\\/g, "/");
   if (/\/docs\/tasks\d*$/.test(norm) || /\/docs\/tasks$/.test(norm)) {
-    return join9(dirname8(dirname8(tasksDir)), ".spur", "run");
+    return join10(dirname8(dirname8(tasksDir)), ".spur", "run");
   }
-  return join9(dirname8(tasksDir), ".spur", "run");
+  return join10(dirname8(tasksDir), ".spur", "run");
 }
 function rowMatchesScenario(id, sc) {
   const stripped = id.replace(/^\[[^\]]*\]\s*/, "").replace(/^Scenario:\s*/i, "").replace(/^\[[^\]]*\]\s*/, "").trim();
@@ -67963,6 +68299,7 @@ var init_feature_check = __esm(() => {
   init_src2();
   init_done_transition_guard();
   init_planning_check_base();
+  init_structural_repair();
   DEFAULT_FEATURE_MATRIX = {
     variants: {
       standard: {
@@ -68037,7 +68374,22 @@ var init_feature_check = __esm(() => {
     }
     async check(filePath, featureId2, options) {
       const strict = options?.strict === true;
-      const raw = await this.fs.readFile(filePath);
+      const rawSource = await this.fs.readFile(filePath);
+      let raw = rawSource;
+      let repairs = [];
+      if (options?.fix === true) {
+        const probe = MarkdownDocument.parse(rawSource, "feature");
+        const probeFm = probe.frontmatterData ?? {};
+        const probeStatus = probeFm.status ?? "backlog";
+        const probeEffective = options?.asStatus ?? probeStatus;
+        const fixEntry = this.resolveMatrixEntry(isGroupFeature(probeFm), probeEffective);
+        const fixed = applyStructuralRepairs(rawSource, "feature", fixEntry);
+        if (fixed.changed) {
+          await this.fs.writeFile(filePath, fixed.content);
+          repairs = fixed.repairs;
+          raw = fixed.content;
+        }
+      }
       const findings = [];
       const doc2 = this.runL1(raw, featureId2, findings);
       if (doc2 === null) {
@@ -68046,18 +68398,22 @@ var init_feature_check = __esm(() => {
       const fm = doc2.frontmatterData ?? {};
       const status = fm.status ?? "backlog";
       const entry = this.resolveMatrixEntry(isGroupFeature(fm), status);
-      this.runL2(doc2, entry, findings);
+      this.runL2(doc2, entry, findings, raw);
       this.runL3(doc2, findings, fm);
       if (options?.featuresDir) {
         await this.checkOneActiveGoal(fm, featureId2, options.featuresDir, findings, options.asStatus);
         await this.checkChildrenLimit(featureId2, options.featuresDir, findings);
       }
-      const dogfoodDir = options?.dogfoodDir ?? (options?.featuresDir ? join9(dirname8(options.featuresDir), "dogfood") : undefined);
+      const dogfoodDir = options?.dogfoodDir ?? (options?.featuresDir ? join10(dirname8(options.featuresDir), "dogfood") : undefined);
       const primaryTasksDir = options?.tasksDir ?? options?.tasksDirs?.[0];
       const runDir = options?.runDir ?? (primaryTasksDir ? defaultVerdictRunDir(primaryTasksDir) : undefined);
       const taskScanDirs = options?.tasksDirs && options.tasksDirs.length > 0 ? options.tasksDirs : options?.tasksDir ? [options.tasksDir] : [];
       await this.runL4(doc2, featureId2, status, taskScanDirs, dogfoodDir, runDir, findings);
-      return { id: featureId2, ...this.summarizeWithStatus(status, findings, strict, options?.severityOverrides) };
+      return {
+        id: featureId2,
+        ...this.summarizeWithStatus(status, findings, strict, options?.severityOverrides),
+        repairs
+      };
     }
     runL3(doc2, findings, fm) {
       const rawAc = doc2.getSection("Acceptance Criteria");
@@ -68494,7 +68850,7 @@ var init_task_locator = __esm(() => {
 });
 
 // ../../packages/app/src/services/task-check.ts
-import { basename as basename3, dirname as dirname9, join as join10 } from "path";
+import { basename as basename3, dirname as dirname9, join as join11 } from "path";
 function isPlaceholderBody(body) {
   const stripped = body.replace(/<!--[\s\S]*?-->/g, "").replace(/^\s*>\s*TBD\s*$/gim, "").trim();
   return stripped.length === 0;
@@ -68696,6 +69052,7 @@ var EXTERNAL_EVIDENCE_RE, TaskCheckService;
 var init_task_check = __esm(() => {
   init_src2();
   init_planning_check_base();
+  init_structural_repair();
   init_task_locator();
   init_verify_verdict();
   EXTERNAL_EVIDENCE_RE = /`([^`\n]+?)`\s+(?:line|lines?)\s+(\d+)(?:-(\d+))?/g;
@@ -68719,7 +69076,23 @@ var init_task_check = __esm(() => {
     }
     async check(filePath, wbs, options) {
       const strict = options?.strict === true;
-      const raw = await this.fs.readFile(filePath);
+      const rawSource = await this.fs.readFile(filePath);
+      let raw = rawSource;
+      let repairs = [];
+      if (options?.fix === true) {
+        const probe = MarkdownDocument.parse(rawSource, "task");
+        const probeFm = probe.frontmatterData ?? {};
+        const probeStatus = probeFm.status ?? "backlog";
+        const probeEffective = options?.asStatus ?? probeStatus;
+        const probeVariant = probeFm.template ?? DEFAULT_TASK_VARIANT;
+        const fixEntry = this.resolveMatrixEntry(probeVariant, probeEffective);
+        const fixed = applyStructuralRepairs(rawSource, "task", fixEntry);
+        if (fixed.changed) {
+          await this.fs.writeFile(filePath, fixed.content);
+          repairs = fixed.repairs;
+          raw = fixed.content;
+        }
+      }
       const findings = [];
       const doc2 = this.runL1(raw, wbs, findings);
       if (doc2 === null) {
@@ -68733,10 +69106,10 @@ var init_task_check = __esm(() => {
       const effectiveStatus = options?.asStatus ?? status;
       const variant = fm.template ?? DEFAULT_TASK_VARIANT;
       const entry = this.resolveMatrixEntry(variant, effectiveStatus);
-      this.runL2(doc2, entry, findings);
+      this.runL2(doc2, entry, findings, raw);
       this.runL3(doc2, entry, effectiveStatus, findings);
       const tasksDir = dirname9(filePath);
-      const featuresDir = join10(dirname9(tasksDir), "features");
+      const featuresDir = join11(dirname9(tasksDir), "features");
       await this.runL4(doc2, fm, effectiveStatus, findings, featuresDir, tasksDir, wbs);
       await this.runL4Rollup(doc2, wbs, effectiveStatus, findings, tasksDir);
       if (effectiveStatus !== "done" && effectiveStatus !== "cancelled") {
@@ -68744,7 +69117,8 @@ var init_task_check = __esm(() => {
       }
       return {
         wbs,
-        ...this.summarizeWithStatus(effectiveStatus, findings, strict, options?.severityOverrides, options?.accepted, wbs)
+        ...this.summarizeWithStatus(effectiveStatus, findings, strict, options?.severityOverrides, options?.accepted, wbs),
+        repairs
       };
     }
     runL3(doc2, entry, status, findings) {
@@ -69171,7 +69545,7 @@ var init_task_check = __esm(() => {
         const body = doc2.getSection(section);
         if (body === null)
           continue;
-        if (/\b(HITL|human[- ]in[- ]the[- ]loop|approval|approved|merge event|merged|content-gate|GATED|capstone)\b/i.test(body)) {
+        if (/(?<![\w-])(HITL|human[- ]in[- ]the-loop|approval|approved|merge event|merged|content-gate|GATED|capstone)(?![\w-])/i.test(body)) {
           findings.push({
             layer: "L4",
             code: FINDING_CODES.L4_GATE_LANGUAGE,
@@ -69227,7 +69601,7 @@ var init_task_check = __esm(() => {
         for (const cite of citations) {
           if (reported >= 5)
             break;
-          const abs = join10(projectRoot, cite.path);
+          const abs = join11(projectRoot, cite.path);
           let exists2 = false;
           try {
             exists2 = await this.fs.exists(abs);
@@ -69309,7 +69683,7 @@ var init_task_check = __esm(() => {
             continue;
           }
           try {
-            const abs = join10(dir, name);
+            const abs = join11(dir, name);
             const stat = await this.fs.stat(abs);
             if (stat !== null && stat !== undefined && stat.isDirectory?.())
               stack.push(abs);
@@ -69404,7 +69778,7 @@ var init_task_check = __esm(() => {
     }
     async checkVerdictArtifact(wbs, tasksDir, findings) {
       const projectRoot = resolveProjectRootFromTasksDir(tasksDir);
-      const runDir = join10(projectRoot, ".spur", "run");
+      const runDir = join11(projectRoot, ".spur", "run");
       const verdictPath = `${runDir}/${wbs}-verdict.json`;
       const outcome = await readVerifyVerdict(this.fs, verdictPath, wbs);
       if (outcome.kind === "missing")
@@ -69449,7 +69823,7 @@ var init_task_check = __esm(() => {
 });
 
 // ../../packages/app/src/services/corpus-check.ts
-import { basename as basename4, dirname as dirname10, join as join11, relative, resolve as resolve3 } from "path";
+import { basename as basename4, dirname as dirname10, join as join12, relative, resolve as resolve3 } from "path";
 function baselineSeverity(e) {
   return e.severity ?? "error";
 }
@@ -69457,7 +69831,7 @@ function resolveProjectRoot(cwd) {
   const fs3 = createNodeFileSystem3(cwd);
   let current = resolve3(cwd);
   while (true) {
-    if (fs3.exists(join11(current, ".spur", "config.yaml")) || fs3.exists(join11(current, "config", "corpus-baseline.json"))) {
+    if (fs3.exists(join12(current, ".spur", "config.yaml")) || fs3.exists(join12(current, "config", "corpus-baseline.json"))) {
       return current;
     }
     const parent = dirname10(current);
@@ -69468,10 +69842,10 @@ function resolveProjectRoot(cwd) {
 }
 async function loadTaskMatrix(projectRoot) {
   const fs3 = createNodeFileSystem3(projectRoot);
-  const candidates = [join11(projectRoot, ".spur", "tasks", "section-matrix.yaml")];
+  const candidates = [join12(projectRoot, ".spur", "tasks", "section-matrix.yaml")];
   const bundledRoot = bundledConfigRoot();
   if (bundledRoot !== null)
-    candidates.push(join11(bundledRoot, "tasks", "section-matrix.yaml"));
+    candidates.push(join12(bundledRoot, "tasks", "section-matrix.yaml"));
   let matrixPath;
   for (const candidate of candidates) {
     if (await fs3.exists(candidate)) {
@@ -69514,7 +69888,7 @@ async function structuralSweep(projectRoot) {
       const wbs = fileName.match(/^(\d{4})_.+\.md$/)?.[1];
       if (wbs === undefined)
         continue;
-      const result = await taskService.check(join11(tasksDir, fileName), wbs, {
+      const result = await taskService.check(join12(tasksDir, fileName), wbs, {
         severityOverrides: planning.severityOverrides
       });
       for (const finding of result.findings) {
@@ -69534,7 +69908,7 @@ async function structuralSweep(projectRoot) {
       const id = fileName.match(/^([A-Z][1-9]*)_.+\.md$/)?.[1];
       if (id === undefined)
         continue;
-      const result = await featureService.check(join11(featuresDir, fileName), id, {
+      const result = await featureService.check(join12(featuresDir, fileName), id, {
         featuresDir,
         tasksDir: activeTasksDir,
         tasksDirs: taskDirs,
@@ -69564,7 +69938,7 @@ async function duplicateIds(cwd, taskDirs, featuresDir) {
       return [];
     }
     const pattern = kind === "task" ? /^(\d{4})_/ : /^([A-Z][0-9]*)_/;
-    return names.map((n2) => ({ m: n2.match(pattern), n: n2 })).filter((x) => x.m !== null).map((x) => ({ id: x.m[1], file: relative(cwd, join11(dir, x.n)), kind }));
+    return names.map((n2) => ({ m: n2.match(pattern), n: n2 })).filter((x) => x.m !== null).map((x) => ({ id: x.m[1], file: relative(cwd, join12(dir, x.n)), kind }));
   };
   const all = [
     ...(await Promise.all(taskDirs.map((dir) => scan(dir, "task")))).flat(),
@@ -69603,14 +69977,14 @@ function diskReader(cwd) {
   return {
     list: async (dir) => {
       try {
-        return (await fs3.readDir(join11(cwd, dir))).map((n2) => `${dir}/${n2}`);
+        return (await fs3.readDir(join12(cwd, dir))).map((n2) => `${dir}/${n2}`);
       } catch {
         return [];
       }
     },
     read: async (path9) => {
       try {
-        return await fs3.readFile(join11(cwd, path9));
+        return await fs3.readFile(join12(cwd, path9));
       } catch {
         return null;
       }
@@ -69802,7 +70176,7 @@ function reconcileBaseline(observed, baseline) {
 }
 async function runCorpusCheck(cwd, since) {
   const projectRoot = resolveProjectRoot(cwd);
-  const baselineFile = join11(projectRoot, "config", "corpus-baseline.json");
+  const baselineFile = join12(projectRoot, "config", "corpus-baseline.json");
   let baseline = { entries: [] };
   if (await Bun.file(baselineFile).exists()) {
     baseline = await Bun.file(baselineFile).json();
@@ -69822,7 +70196,7 @@ async function runCorpusCheck(cwd, since) {
 }
 async function loadAcceptedFindings(cwd) {
   const projectRoot = resolveProjectRoot(cwd);
-  const baselineFile = join11(projectRoot, "config", "corpus-baseline.json");
+  const baselineFile = join12(projectRoot, "config", "corpus-baseline.json");
   const accepted = new Map;
   try {
     if (await Bun.file(baselineFile).exists()) {
@@ -69852,7 +70226,7 @@ var init_corpus_check = __esm(() => {
 });
 
 // ../../packages/app/src/services/corpus-migrator.ts
-import { join as join12, relative as relative2 } from "path";
+import { join as join13, relative as relative2 } from "path";
 function applyM1(data, flags) {
   const raw = data.status;
   if (typeof raw !== "string")
@@ -70152,7 +70526,7 @@ class CorpusMigrator {
   }
   async discoverFiles() {
     const entries = await this.fs.readDir(this.corpusDir);
-    return entries.filter((name) => name.endsWith(".md")).filter((name) => name !== "kanban.md").map((name) => join12(this.corpusDir, name)).sort();
+    return entries.filter((name) => name.endsWith(".md")).filter((name) => name !== "kanban.md").map((name) => join13(this.corpusDir, name)).sort();
   }
   async migrateFile(filePath, dryRun, gitDates = new Map) {
     const flags = [];
@@ -73000,15 +73374,15 @@ var init_feature_service = __esm(() => {
 import {
   existsSync as existsSync5,
   mkdirSync as mkdirSync6,
-  readdirSync as readdirSync5,
+  readdirSync as readdirSync6,
   readFileSync as readFileSync8,
   readlinkSync,
-  rmSync as rmSync3,
+  rmSync as rmSync4,
   symlinkSync,
   unlinkSync as unlinkSync2,
   writeFileSync as writeFileSync4
 } from "fs";
-import { dirname as dirname11, isAbsolute as isAbsolute3, join as join13, resolve as resolve4 } from "path";
+import { dirname as dirname11, isAbsolute as isAbsolute3, join as join14, resolve as resolve4 } from "path";
 async function buildRefreshCoverage(db2, selector, fanOut) {
   const statusBySource = new Map(fanOut.entries.map((e) => [e.source, e.status]));
   const refreshed = FULL_FIDELITY_SOURCES.filter((s3) => statusBySource.has(s3) && statusBySource.get(s3) !== "failed");
@@ -73157,8 +73531,9 @@ class HistoryService {
     const timeoutMs = opts.sourceTimeout ?? DEFAULT_SOURCE_TIMEOUT_MS;
     const entries = [];
     const warnings = [];
+    const runStartedAt = new Date().toISOString();
     for (const source of sources) {
-      const { coverageEntry, sourceWarnings } = await this.importOneIsolated(source, opts, timeoutMs);
+      const { coverageEntry, sourceWarnings } = await this.importOneIsolated(source, opts, timeoutMs, runStartedAt);
       entries.push(coverageEntry);
       warnings.push(...sourceWarnings);
     }
@@ -73193,10 +73568,11 @@ class HistoryService {
       writeFileSync4(reportPath, renderMarkdown(artifact, opts.mode));
     }
     const pruned = pruneReports(cwd, REPORT_RETENTION_DAYS);
+    const retained = await runRetention(db2, cwd);
     const coverage = await buildRefreshCoverage(db2, selector, fanOut);
-    return { fanOut, artifact, pruned, coverage, ...reportPath !== undefined ? { reportPath } : {} };
+    return { fanOut, artifact, pruned, retained, coverage, ...reportPath !== undefined ? { reportPath } : {} };
   }
-  async importOneIsolated(source, opts, timeoutMs) {
+  async importOneIsolated(source, opts, timeoutMs, runStartedAt) {
     const db2 = await this.ctx.getDb();
     const sourceWarnings = [];
     const checkpointCount = await countCheckpointsBySource(db2, source);
@@ -73235,12 +73611,13 @@ class HistoryService {
           detail: `source '${source}' previously had checkpoint rows but discovered 0 files`
         });
       }
+      const toolCalls = opts.dryRun ? 0 : await countToolCallsSince(db2, source, runStartedAt);
       const coverageEntry = {
         source,
         status,
         files: result.scannedFiles,
         messages: result.importedRecords,
-        toolCalls: 0,
+        toolCalls,
         unknownRecords: result.unknownRecords,
         lastImportedAt: null,
         parseErrors: result.parseErrors.length,
@@ -73292,7 +73669,7 @@ function emptyTotals2() {
 function foldMessage(bucket, row) {
   bucket.messages += row.messages;
   bucket.records += row.messages;
-  bucket.inputTokens += row.inputTokens ?? 0;
+  bucket.inputTokens += (row.inputTokens ?? 0) + (row.cacheReadTokens ?? 0) + (row.cacheWriteTokens ?? 0);
   bucket.outputTokens += row.outputTokens ?? 0;
   bucket.cacheReadTokens += row.cacheReadTokens ?? 0;
   bucket.cacheWriteTokens += row.cacheWriteTokens ?? 0;
@@ -73440,9 +73817,9 @@ function resolveArtifactPaths(artifact, opts) {
     return { artifactPath: out, sidecarPath: `${out.replace(/\.json$/, "")}.errors.jsonl` };
   }
   const base2 = resolve4(opts.cwd, ".spur", "reports", "history");
-  const dateDir = join13(base2, artifact.generatedAt.slice(0, 10));
+  const dateDir = join14(base2, artifact.generatedAt.slice(0, 10));
   const name = `analyze-${selectorDigest(artifact.selector)}`;
-  return { artifactPath: join13(dateDir, `${name}.json`), sidecarPath: join13(dateDir, `${name}.errors.jsonl`) };
+  return { artifactPath: join14(dateDir, `${name}.json`), sidecarPath: join14(dateDir, `${name}.errors.jsonl`) };
 }
 function boundCoverage(coverage) {
   const overflow = [];
@@ -73465,7 +73842,7 @@ function boundCoverage(coverage) {
 }
 function updateLatestPointer(opts, artifactPath) {
   const base2 = resolve4(opts.cwd, ".spur", "reports", "history");
-  const latest = join13(base2, "latest.json");
+  const latest = join14(base2, "latest.json");
   mkdirSync6(base2, { recursive: true });
   if (existsSync5(latest))
     unlinkSync2(latest);
@@ -73531,10 +73908,10 @@ function formatIssue(issue2) {
   return `${issue2.sourceFile}:${issue2.sourceLine}: ${issue2.reason}`;
 }
 function pruneReports(cwd, retentionDays = REPORT_RETENTION_DAYS, now2 = new Date) {
-  const dir = join13(cwd, ".spur", "reports", "history");
+  const dir = join14(cwd, ".spur", "reports", "history");
   let entries;
   try {
-    entries = readdirSync5(dir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
+    entries = readdirSync6(dir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
   } catch {
     return [];
   }
@@ -73549,7 +73926,7 @@ function pruneReports(cwd, retentionDays = REPORT_RETENTION_DAYS, now2 = new Dat
     if (entryDate >= cutoff)
       continue;
     try {
-      rmSync3(join13(dir, name), { recursive: true, force: true });
+      rmSync4(join14(dir, name), { recursive: true, force: true });
       pruned.push(name);
     } catch {}
   }
@@ -73880,6 +74257,16 @@ async function ensurePipelineRunLink(db2, wbs, options = {}) {
   const links = await dao2.listByWbs(wbs, 20);
   const existing = links.find((l) => l.kind === "pipeline");
   if (existing) {
+    if (options.runId !== undefined && options.runId !== existing.run_id) {
+      await dao2.updateRunId(existing.id, options.runId);
+      return {
+        created: false,
+        id: existing.id,
+        wbs: existing.wbs,
+        runId: options.runId,
+        kind: "pipeline"
+      };
+    }
     return {
       created: false,
       id: existing.id,
@@ -74376,17 +74763,17 @@ var init_process_inventory_service = __esm(() => {
 });
 
 // ../../packages/app/src/services/project-registry.ts
-import { existsSync as existsSync6, mkdirSync as mkdirSync7, readFileSync as readFileSync9, realpathSync as realpathSync3, renameSync as renameSync4, rmSync as rmSync4, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync6, mkdirSync as mkdirSync7, readFileSync as readFileSync9, realpathSync as realpathSync3, renameSync as renameSync4, rmSync as rmSync5, writeFileSync as writeFileSync5 } from "fs";
 import { connect, createServer } from "net";
 import { homedir as homedir5 } from "os";
-import { dirname as dirname12, join as join14, resolve as resolve5 } from "path";
+import { dirname as dirname12, join as join15, resolve as resolve5 } from "path";
 function normalizeProjectPath(pathInput) {
   const trimmed = pathInput.trim();
   let expanded = trimmed;
   if (trimmed === "~") {
     expanded = homedir5();
   } else if (trimmed.startsWith("~/")) {
-    expanded = join14(homedir5(), trimmed.slice(2));
+    expanded = join15(homedir5(), trimmed.slice(2));
   } else {
     expanded = resolve5(trimmed);
   }
@@ -74509,7 +74896,7 @@ class ProjectRegistry {
     }
     if (!acquired) {
       try {
-        rmSync4(this.lockDir, { recursive: true, force: true });
+        rmSync5(this.lockDir, { recursive: true, force: true });
         mkdirSync7(this.lockDir);
         acquired = true;
       } catch {
@@ -74521,7 +74908,7 @@ class ProjectRegistry {
     } finally {
       if (acquired) {
         try {
-          rmSync4(this.lockDir, { recursive: true, force: true });
+          rmSync5(this.lockDir, { recursive: true, force: true });
         } catch {}
       }
     }
@@ -74826,7 +75213,7 @@ var init_project_start = __esm(() => {
 
 // ../../packages/app/src/services/rule-service.ts
 import { homedir as homedir6 } from "os";
-import { delimiter, join as join15, relative as relative3, resolve as resolve7 } from "path";
+import { delimiter, join as join16, relative as relative3, resolve as resolve7 } from "path";
 
 class RuleService {
   context;
@@ -75021,13 +75408,13 @@ ${ruleIds.join(`
     const hasGlobalOverride = globalOverride !== undefined && globalOverride.length > 0;
     layers.push({
       id: "global",
-      path: hasGlobalOverride ? resolve7(cwd, globalOverride) : join15(homedir6(), GLOBAL_RULES_DIR),
+      path: hasGlobalOverride ? resolve7(cwd, globalOverride) : join16(homedir6(), GLOBAL_RULES_DIR),
       priority: 10
     });
     if (opts.includeBundled && !hasGlobalOverride) {
       const bundledConfig = bundledConfigRoot();
       if (bundledConfig !== null) {
-        layers.push({ id: "bundled-config", path: join15(bundledConfig, "rules"), priority: 15 });
+        layers.push({ id: "bundled-config", path: join16(bundledConfig, "rules"), priority: 15 });
       }
       const bundled = await bundledRulesRoot();
       if (bundled !== null)
@@ -75240,7 +75627,7 @@ ${ruleIds.join(`
     const { fs: fs3 } = this.context;
     for (const root of await this.ruleRoots()) {
       for (const ext of ["yaml", "yml", "json"]) {
-        if (await fs3.exists(join15(root, `${name}.${ext}`)))
+        if (await fs3.exists(join16(root, `${name}.${ext}`)))
           return true;
       }
     }
@@ -75276,7 +75663,7 @@ ${ruleIds.join(`
     for (const layer of await this.existingRuleSourceLayers()) {
       const entries = await this.context.fs.readDir(layer.path);
       const named = entries.map((entry) => ({ entry, name: entry.match(/^([\w-]+)\.(?:ya?ml|json)$/i)?.[1] ?? "" })).filter(({ name }) => name.length > 0);
-      const stats = await Promise.all(named.map(({ entry }) => this.context.fs.stat(join15(layer.path, entry))));
+      const stats = await Promise.all(named.map(({ entry }) => this.context.fs.stat(join16(layer.path, entry))));
       named.forEach(({ name }, i2) => {
         if (stats[i2]?.isFile())
           candidates.add(name);
@@ -75298,7 +75685,7 @@ ${ruleIds.join(`
     for (const layer of layers) {
       for (const file2 of await this.listRuleFilesInLayer(layer.path)) {
         if (!merged.has(file2))
-          merged.set(file2, { absolutePath: join15(layer.path, file2), source: layer.id });
+          merged.set(file2, { absolutePath: join16(layer.path, file2), source: layer.id });
       }
     }
     const files = [];
@@ -75366,7 +75753,7 @@ ${ruleIds.join(`
     for (const entry of entries.sort()) {
       if (entry === "presets")
         continue;
-      const stat = await this.context.fs.stat(join15(root, entry));
+      const stat = await this.context.fs.stat(join16(root, entry));
       if (stat?.isDirectory())
         dirs.push(entry);
     }
@@ -75374,12 +75761,12 @@ ${ruleIds.join(`
   }
   async listRuleFiles(root, relativeDir) {
     const { fs: fs3 } = this.context;
-    const dir = join15(root, relativeDir);
+    const dir = join16(root, relativeDir);
     const entries = await fs3.readDir(dir);
     const files = [];
     for (const entry of entries.sort()) {
-      const relativePath2 = relativeDir.length === 0 ? entry : join15(relativeDir, entry);
-      const absolutePath = join15(root, relativePath2);
+      const relativePath2 = relativeDir.length === 0 ? entry : join16(relativeDir, entry);
+      const absolutePath = join16(root, relativePath2);
       const stat = await fs3.stat(absolutePath);
       if (stat?.isDirectory()) {
         files.push(...await this.listRuleFiles(root, relativePath2));
@@ -75513,8 +75900,8 @@ var init_rule_service = __esm(() => {
   init_dist10();
   init_agent_execution();
   init_system_event_envelope();
-  LOCAL_RULES_DIR = join15(".spur", "rules");
-  GLOBAL_RULES_DIR = join15(".config", "spur", "rules");
+  LOCAL_RULES_DIR = join16(".spur", "rules");
+  GLOBAL_RULES_DIR = join16(".config", "spur", "rules");
   SEVERITY_RANK2 = {
     info: 0,
     warning: 1,
@@ -76132,12 +76519,12 @@ class SystemEventEmitter {
   secretValues;
   projectContext;
   quotas;
-  constructor(dao2, logger3, retention = {}, secretValues = [], projectContext = systemEventProjectContext("")) {
+  constructor(dao2, logger3, retention2 = {}, secretValues = [], projectContext = systemEventProjectContext("")) {
     this.dao = dao2;
     this.logger = logger3;
     this.secretValues = secretValues;
     this.projectContext = projectContext;
-    this.quotas = resolveRetentionQuotas(retention);
+    this.quotas = resolveRetentionQuotas(retention2);
   }
   async emit(event) {
     const entry = systemEventCatalogEntry(event.event);
@@ -76519,7 +76906,7 @@ var init_task_size_precheck = __esm(() => {
 });
 
 // ../../packages/app/src/services/task-service.ts
-import { dirname as dirname14, isAbsolute as isAbsolute4, join as join16, relative as relative4 } from "path";
+import { dirname as dirname14, isAbsolute as isAbsolute4, join as join17, relative as relative4 } from "path";
 function renderRosterTable(rows) {
   const header = `| WBS | Sub-task | Status |
 | --- | -------- | ------ |`;
@@ -76943,7 +77330,7 @@ class TaskService {
       if (!featureId2 || featureId2.length === 0)
         return [];
       const tasksDir = dirname14(taskFilePath);
-      const featuresDir = join16(tasksDir, "..", "features");
+      const featuresDir = join17(tasksDir, "..", "features");
       const featurePath = await (async () => {
         try {
           for (const name of await this.ctx.fs.readDir(featuresDir)) {
@@ -76986,9 +77373,11 @@ class TaskService {
       reviewWritten: false,
       solutionBackfilled: false
     };
-    const testingBody = renderTesting(verdict);
-    await this.writeService.updateSection(ref, "Testing", testingBody);
-    result.testingWritten = true;
+    if (!(verdict.verdict === "UNKNOWN" && !sectionIsBare(doc2, "Testing"))) {
+      const testingBody = renderTesting(verdict);
+      await this.writeService.updateSection(ref, "Testing", testingBody);
+      result.testingWritten = true;
+    }
     if (sectionIsBare(doc2, "Review")) {
       const reviewBody = renderReview(verdict);
       await this.writeService.updateSection(ref, "Review", reviewBody);
@@ -77691,7 +78080,7 @@ var init_task_verdict = __esm(() => {
 });
 
 // ../../packages/app/src/services/team-service.ts
-import { join as join17, resolve as resolve8 } from "path";
+import { join as join18, resolve as resolve8 } from "path";
 
 class TeamService {
   ctx;
@@ -77699,7 +78088,7 @@ class TeamService {
   orchestratorPromise;
   constructor(ctx) {
     this.ctx = ctx;
-    this.configDir = join17(ctx.cwd, ".spur", "agents");
+    this.configDir = join18(ctx.cwd, ".spur", "agents");
   }
   async sendMessage(fromId, toId, body, replyTo) {
     validateAgentId(toId);
@@ -78167,7 +78556,7 @@ class TeamService {
   async resolveTaskFile(taskId) {
     const fs3 = this.ctx.fs;
     const { foldersConfig } = await resolvePlanningFolders(fs3);
-    const dirs = [...new Set([foldersConfig.active_folder, ...Object.keys(foldersConfig.folders)])].map((dir) => join17(this.ctx.cwd, dir));
+    const dirs = [...new Set([foldersConfig.active_folder, ...Object.keys(foldersConfig.folders)])].map((dir) => join18(this.ctx.cwd, dir));
     return await TaskLocator.forDirs(fs3, dirs).findPathByWbs(taskId);
   }
 }
@@ -78205,7 +78594,7 @@ var init_team_service = __esm(() => {
 
 // ../../packages/app/src/services/token-ledger-service.ts
 import { closeSync as closeSync3, existsSync as existsSync8, fstatSync, openSync as openSync3, readSync } from "fs";
-import { join as join18 } from "path";
+import { join as join19 } from "path";
 function isSparseToolActivity(events2) {
   return events2.length === 0 || !events2.some((e) => TOOL_ACTIVITY_TYPES.has(e.type));
 }
@@ -78306,7 +78695,7 @@ class TokenLedgerService {
   ledgerPath;
   chunkSize;
   constructor(options) {
-    this.ledgerPath = options.ledgerPath ?? join18(options.cwd, TOKEN_LEDGER_RELATIVE_PATH);
+    this.ledgerPath = options.ledgerPath ?? join19(options.cwd, TOKEN_LEDGER_RELATIVE_PATH);
     this.chunkSize = options.chunkSize ?? DEFAULT_CHUNK;
   }
   get path() {
@@ -78347,7 +78736,7 @@ class TokenLedgerService {
 var TOOL_ACTIVITY_TYPES, TOKEN_LEDGER_DEFAULT_LIMIT = 200, TOKEN_LEDGER_MAX_LIMIT = 1000, TOKEN_LEDGER_RELATIVE_PATH, DEFAULT_CHUNK;
 var init_token_ledger_service = __esm(() => {
   TOOL_ACTIVITY_TYPES = new Set(["read", "write", "bash", "grep", "glob"]);
-  TOKEN_LEDGER_RELATIVE_PATH = join18(".spur", "context", "token-ledger.jsonl");
+  TOKEN_LEDGER_RELATIVE_PATH = join19(".spur", "context", "token-ledger.jsonl");
   DEFAULT_CHUNK = 64 * 1024;
 });
 
@@ -78717,7 +79106,7 @@ var init_steering = __esm(() => {
 
 // ../../packages/app/src/workflow/actions/agent-run.ts
 import { tmpdir } from "os";
-import { dirname as dirname15, isAbsolute as isAbsolute5, join as join19 } from "path";
+import { dirname as dirname15, isAbsolute as isAbsolute5, join as join20 } from "path";
 
 class AgentRunActionRunner {
   observabilityBus;
@@ -78754,11 +79143,11 @@ class AgentRunActionRunner {
     let sessionDir = asOptionalString(context4.vars.__agentSessionDir);
     if (affinityOn) {
       if (!sessionDir || prevAgent && prevAgent !== targetAgentDir) {
-        sessionDir = join19(cwd, ".spur", "run", context4.runId, "agent-sessions", targetAgentDir);
+        sessionDir = join20(cwd, ".spur", "run", context4.runId, "agent-sessions", targetAgentDir);
       }
     } else {
       if (!sessionDir) {
-        sessionDir = join19(cwd, ".spur", "run", context4.runId, "agent-sessions", targetAgentDir);
+        sessionDir = join20(cwd, ".spur", "run", context4.runId, "agent-sessions", targetAgentDir);
       }
     }
     const storedSessionId = asOptionalString(context4.vars.__agentSessionId);
@@ -78868,13 +79257,13 @@ class AgentRunActionRunner {
       const ok = exitCode === 0;
       const invocation = traced.invocation;
       if (capture && answerFile !== undefined) {
-        const target = isAbsolute5(answerFile) ? answerFile : join19(cwd, answerFile);
+        const target = isAbsolute5(answerFile) ? answerFile : join20(cwd, answerFile);
         const fs3 = createNodeFileSystem3(cwd);
         await fs3.ensureDir(dirname15(target));
         await fs3.writeFile(target, answer);
       }
       if (ok && expectFile !== undefined) {
-        const target = isAbsolute5(expectFile) ? expectFile : join19(cwd, expectFile);
+        const target = isAbsolute5(expectFile) ? expectFile : join20(cwd, expectFile);
         const fs3 = createNodeFileSystem3(cwd);
         if (!await fs3.exists(target)) {
           return {
@@ -78913,7 +79302,7 @@ class AgentRunActionRunner {
       const resolvedAgent = invocation?.agent ?? targetAgentDir;
       let resolvedSessionDir = sessionDir;
       if (ok && affinityOn && resolvedAgent !== targetAgentDir && !context4.vars.__agentSessionDir) {
-        resolvedSessionDir = join19(cwd, ".spur", "run", context4.runId, "agent-sessions", resolvedAgent);
+        resolvedSessionDir = join20(cwd, ".spur", "run", context4.runId, "agent-sessions", resolvedAgent);
       }
       let discoveredSessionId = storedSessionId;
       if (ok && affinityOn && resolvedSessionDir && !discoveredSessionId) {
@@ -78921,7 +79310,7 @@ class AgentRunActionRunner {
       }
       if (ok && affinityOn && resolvedSessionDir) {
         try {
-          const sidecarPath = join19(cwd, ".spur", "run", `${context4.runId}-agent-session.json`);
+          const sidecarPath = join20(cwd, ".spur", "run", `${context4.runId}-agent-session.json`);
           const fs3 = createNodeFileSystem3(cwd);
           await fs3.ensureDir(dirname15(sidecarPath));
           await fs3.writeFile(sidecarPath, JSON.stringify({
@@ -78964,7 +79353,7 @@ async function discoverSessionId(sessionDir) {
     let newestFile;
     let newestMtime = 0;
     for (const entry of jsonEntries) {
-      const fullPath = join19(sessionDir, entry);
+      const fullPath = join20(sessionDir, entry);
       const st = await fs3.stat(fullPath);
       if (st?.isFile() && st.mtimeMs > newestMtime) {
         newestMtime = st.mtimeMs;
@@ -79060,7 +79449,7 @@ async function writePartialWorkArtifact(context4, agentLabel, model, traced, cwd
     const headerLine = model !== undefined ? `${agentLabel} (model: ${model})` : agentLabel;
     const inv = traced.invocation;
     const argvLine = inv ? `${inv.command} ${inv.argv.join(" ")}` : "(invocation not captured)";
-    const latchedSessionPath = join19(cwd, ".spur", "run", `${context4.runId}-agent-session.json`);
+    const latchedSessionPath = join20(cwd, ".spur", "run", `${context4.runId}-agent-session.json`);
     const resumeContext = [
       "",
       "## resume context",
@@ -79076,9 +79465,9 @@ async function writePartialWorkArtifact(context4, agentLabel, model, traced, cwd
       try {
         const fs4 = createNodeFileSystem3(cwd);
         const locator = TaskLocator.forDirs(fs4, [
-          join19(cwd, "docs", "tasks3"),
-          join19(cwd, "docs", "tasks2"),
-          join19(cwd, "docs", "tasks")
+          join20(cwd, "docs", "tasks3"),
+          join20(cwd, "docs", "tasks2"),
+          join20(cwd, "docs", "tasks")
         ]);
         const hit = await locator.findByWbs(wbs);
         if (hit) {
@@ -79134,7 +79523,7 @@ async function writePartialWorkArtifact(context4, agentLabel, model, traced, cwd
       completedSection
     ].join(`
 `);
-    const target = join19(cwd, ".spur", "run", `${context4.runId}-${context4.stateOrNodeId}-partial.md`);
+    const target = join20(cwd, ".spur", "run", `${context4.runId}-${context4.stateOrNodeId}-partial.md`);
     const fs3 = createNodeFileSystem3(cwd);
     await fs3.ensureDir(dirname15(target));
     await fs3.writeFile(target, body);
@@ -79156,7 +79545,7 @@ async function gitDiffStat(cwd) {
   }
 }
 async function createGitWorkingTreeSnapshot(cwd, excludeGlobs = ["docs/tasks3/*", "docs/features/*"]) {
-  const indexFile = join19(tmpdir(), `spur-implement-scope-${crypto.randomUUID()}.index`);
+  const indexFile = join20(tmpdir(), `spur-implement-scope-${crypto.randomUUID()}.index`);
   const fs3 = createNodeFileSystem3(cwd);
   let keepIndex = false;
   try {
@@ -79287,9 +79676,9 @@ async function findOutOfScopeChanges(cwd, wbs, changed) {
   try {
     const fs3 = createNodeFileSystem3(cwd);
     const locator = TaskLocator.forDirs(fs3, [
-      join19(cwd, "docs", "tasks3"),
-      join19(cwd, "docs", "tasks2"),
-      join19(cwd, "docs", "tasks")
+      join20(cwd, "docs", "tasks3"),
+      join20(cwd, "docs", "tasks2"),
+      join20(cwd, "docs", "tasks")
     ]);
     const hit = await locator.findByWbs(wbs);
     if (!hit)
@@ -79516,9 +79905,10 @@ function parseDoctorJson(stdout) {
     const first = parsed.agents?.[0];
     const auth = typeof first?.authenticated === "string" ? first.authenticated : "unknown";
     const detail = typeof first?.modelStatus?.detail === "string" ? first.modelStatus.detail : "";
-    return { auth, detail };
+    const resolvedAgent = typeof first?.agent === "string" && first.agent.length > 0 ? first.agent : "";
+    return { auth, detail, resolvedAgent };
   } catch {
-    return { auth: "unknown", detail: "" };
+    return { auth: "unknown", detail: "", resolvedAgent: "" };
   }
 }
 
@@ -79604,18 +79994,20 @@ ${res.stderr}`.trim();
         status = "FAIL";
         continue;
       }
-      const { auth, detail } = parseDoctorJson(res.stdout);
-      const probe = classifyDoctorProbe(detail, exe);
-      const line = `precheck: ${exe} auth=${auth} probe=${probe} ${detail}`.replace(/\s+$/, "");
+      const { auth, detail, resolvedAgent } = parseDoctorJson(res.stdout);
+      const classifyAgainst = resolvedAgent !== "" ? resolvedAgent : exe;
+      const probe = classifyDoctorProbe(detail, classifyAgainst);
+      const resolvedSuffix = resolvedAgent !== "" && resolvedAgent !== exe ? ` (resolved ${resolvedAgent})` : "";
+      const line = `precheck: ${exe}${resolvedSuffix} auth=${auth} probe=${probe} ${detail}`.replace(/\s+$/, "");
       lines.push(line);
       emit(line);
       if (auth === "unauthenticated") {
-        if (RELAY_FAMILY.test(exe) && (probe === "env-miss" || probe === "unknown")) {
-          const soft = `precheck: SOFT - executor ${exe} auth probe cannot see agent-owned credentials`;
+        if (RELAY_FAMILY.test(classifyAgainst) && (probe === "env-miss" || probe === "unknown")) {
+          const soft = `precheck: SOFT - executor ${classifyAgainst} auth probe cannot see agent-owned credentials`;
           lines.push(soft);
           emit(soft);
         } else {
-          const hard = `precheck: FAIL - executor ${exe} is unauthenticated; fix agent.default or pass --vars '{"agent":"<authenticated-executor>"}' (${spurBin} agent doctor ${exe} --json); ${detail}`;
+          const hard = `precheck: FAIL - executor ${classifyAgainst} is unauthenticated; fix agent.default or pass --vars '{"agent":"<authenticated-executor>"}' (${spurBin} agent doctor ${classifyAgainst} --json); ${detail}`;
           lines.push(hard);
           emit(hard);
           status = "FAIL";
@@ -80270,9 +80662,9 @@ var init_composition_baseline = __esm(() => {
 // ../../packages/app/src/workflow/proof-input-fingerprint.ts
 import crypto4 from "crypto";
 import { tmpdir as tmpdir2 } from "os";
-import { dirname as dirname16, join as join20 } from "path";
+import { dirname as dirname16, join as join21 } from "path";
 async function createGitAlternateTree(cwd, excludeGlobs = DEFAULT_EXCLUDE_GLOBS, executor = new NodeProcessExecutor3, fs3 = createNodeFileSystem3()) {
-  const indexFile = join20(tmpdir2(), `spur-proof-fingerprint-${crypto4.randomUUID()}.index`);
+  const indexFile = join21(tmpdir2(), `spur-proof-fingerprint-${crypto4.randomUUID()}.index`);
   try {
     await fs3.ensureDir(dirname16(indexFile));
     const env = Object.fromEntries(Object.entries(process.env).filter((entry) => entry[1] !== undefined));
@@ -80818,8 +81210,9 @@ var init_builtins2 = __esm(() => {
 });
 
 // ../../packages/app/src/services/workflow-service.ts
+import { existsSync as existsSync10, readFileSync as readFileSync10 } from "fs";
 import { homedir as homedir7 } from "os";
-import { dirname as dirname17, join as join21, resolve as resolve13 } from "path";
+import { basename as basename7, dirname as dirname17, join as join22, resolve as resolve13 } from "path";
 function signalSubprocess(pid) {
   if (!Number.isInteger(pid) || pid <= 1)
     return false;
@@ -80955,8 +81348,9 @@ class WorkflowAppService {
       if (roleErrors.length > 0) {
         return { ok: false, valid: false, file: file2, errors: roleErrors };
       }
+      const composition = collectCompositionAdvisory(workflow, absolute);
       await this.loadWorkflowExtensions(createDefaultWorkflowEngineHost(), workflow, absolute);
-      return { ok: true, valid: true, workflow };
+      return { ok: true, valid: true, workflow, composition };
     } catch (error51) {
       return {
         ok: false,
@@ -81073,7 +81467,7 @@ class WorkflowAppService {
     };
   }
   async cleanRunLogs(retentionDays = 30, dryRun = false) {
-    const runDir = join21(this.ctx.cwd, ".spur", "run");
+    const runDir = join22(this.ctx.cwd, ".spur", "run");
     const fs3 = createNodeFileSystem3();
     const cutoffMs = Date.now() - retentionDays * 24 * 60 * 60 * 1000;
     const reclaimed = [];
@@ -81085,7 +81479,7 @@ class WorkflowAppService {
       return { retentionDays, dryRun, reclaimed, failures };
     }
     for (const name of entries) {
-      const path9 = join21(runDir, name);
+      const path9 = join22(runDir, name);
       const stat = await fs3.stat(path9);
       if (stat === null || !stat.isFile() || stat.mtimeMs >= cutoffMs)
         continue;
@@ -81169,7 +81563,7 @@ class WorkflowAppService {
   }
   async list(workflowPaths = [".spur/workflows/"]) {
     const projectRoot = this.ctx.cwd;
-    const globalRoot = join21(homedir7(), ".config", "spur");
+    const globalRoot = join22(homedir7(), ".config", "spur");
     const layers = [];
     const entries = [];
     const scannedPaths = new Set;
@@ -81443,6 +81837,100 @@ function collectAgentRunRoleViolations(def) {
   }
   return violations;
 }
+function collectCompositionAdvisory(def, workflowFile) {
+  const findings = [];
+  let suppressed = 0;
+  const shellLines = (command) => command.split(/\n|;/).map((u2) => u2.trim()).filter((u2) => u2.length > 0 && !u2.startsWith("#")).length;
+  const agentRunSeverity = (prompt) => {
+    if (prompt.length < 200)
+      return "low";
+    if (prompt.length <= 1000)
+      return "medium";
+    return "high";
+  };
+  const baseline = loadCompositionBaselineFor(workflowFile);
+  const workflowName = basename7(workflowFile, ".yaml");
+  const adjudicated = (actionKey) => {
+    if (!baseline)
+      return false;
+    const entry = baseline.workflows[workflowName];
+    if (!entry)
+      return false;
+    const action = entry.actions[actionKey];
+    return action?.disposition !== undefined;
+  };
+  const visitAction = (stateId, action, idx, phase) => {
+    const actionKey = `${stateId}:${phase}:${idx}`;
+    if (action.kind === "shell") {
+      const cmd = action.options?.command;
+      if (typeof cmd !== "string" || cmd.length === 0)
+        return;
+      const measured = shellLines(cmd);
+      if (measured < 6)
+        return;
+      if (adjudicated(actionKey)) {
+        suppressed += 1;
+        return;
+      }
+      findings.push({
+        workflow: workflowName,
+        state: stateId,
+        actionKey,
+        measure: { kind: "shell-lines", measured, threshold: 6 },
+        recommendation: `shell action at ${actionKey} measures ${measured} lines (>5 frozen threshold, ADR-069) \u2014 extract to a script or record a disposition in config/workflow-composition-baseline.json`
+      });
+    } else if (action.kind === "agent.run") {
+      const input = action.options?.input;
+      if (typeof input !== "string" || input.length === 0)
+        return;
+      if (input.trimStart().startsWith("/"))
+        return;
+      if (adjudicated(actionKey)) {
+        suppressed += 1;
+      } else {
+        const severity = agentRunSeverity(input);
+        findings.push({
+          workflow: workflowName,
+          state: stateId,
+          actionKey,
+          measure: { kind: "agent-run-chars", measured: input.length, severity },
+          recommendation: `agent.run prompt at ${actionKey} is ${input.length} chars, not slash-pinned (severity ${severity}) \u2014 pin to a slash command or a script with a bounded prompt`
+        });
+      }
+    }
+  };
+  if (def.kind === "transition-flow" || def.kind === undefined) {
+    const flowDef = def;
+    for (const node of flowDef.nodes ?? []) {
+      if (node.action)
+        visitAction(node.id, node.action, 0, "onEnter");
+    }
+  } else {
+    const smDef = def;
+    for (const state of smDef.states ?? []) {
+      for (const [i2, action] of (state.onEnter ?? []).entries())
+        visitAction(state.id, action, i2, "onEnter");
+      for (const [i2, action] of (state.onExit ?? []).entries())
+        visitAction(state.id, action, i2, "onExit");
+    }
+  }
+  return { findings, suppressed };
+}
+function loadCompositionBaselineFor(workflowFile) {
+  let dir = dirname17(resolve13(workflowFile));
+  for (let i2 = 0;i2 < 10; i2++) {
+    const candidate = join22(dir, "config/workflow-composition-baseline.json");
+    if (existsSync10(candidate)) {
+      try {
+        return JSON.parse(readFileSync10(candidate, "utf8"));
+      } catch {
+        return;
+      }
+    }
+    dir = dirname17(dir);
+  }
+  return;
+}
 async function fileExists(path9) {
   const fs3 = createNodeFileSystem3();
   return await fs3.exists(path9);
@@ -81495,8 +81983,8 @@ async function resolveOutputLogConfig(cwd) {
   }
 }
 async function outputArtifactForRun(cwd, runId) {
-  const relative5 = join21(".spur", "run", `${runId}.log`);
-  return await fileExists(join21(cwd, relative5)) ? relative5 : undefined;
+  const relative5 = join22(".spur", "run", `${runId}.log`);
+  return await fileExists(join22(cwd, relative5)) ? relative5 : undefined;
 }
 async function scanWorkflowFiles(rootPath, source) {
   const entries = [];
@@ -81671,7 +82159,7 @@ function projectActionTraceResult(resultJson, secretValues = []) {
 async function partialArtifactForAction(cwd, runId, node, ok) {
   if (ok !== false || !TRACE_IDENTIFIER.test(runId) || !TRACE_IDENTIFIER.test(node))
     return;
-  const relativePath2 = join21(".spur", "run", `${runId}-${node}-partial.md`);
+  const relativePath2 = join22(".spur", "run", `${runId}-${node}-partial.md`);
   return await fileExists(resolve13(cwd, relativePath2)) ? relativePath2 : undefined;
 }
 var TASK_PIPELINE_WORKFLOW = "task-pipeline", EMBEDDED_SCHEMA_PREFIX = "\x00embedded-spur", SPUR_SCHEMA_MANIFEST = "@gobing-ai/spur/package.json", PIPELINE_LINK_KIND = "pipeline", TRACE_IDENTIFIER, TRACE_RESULT_FIELDS, TRACE_INVOCATION_FIELDS;
@@ -81903,7 +82391,8 @@ class LifecycleAdapter {
     const db2 = await this.opts.getDb();
     const host = createDefaultWorkflowEngineHost();
     host.registerGuard(new EnvShellGuardRunner(new NodeProcessExecutor3), "builtin");
-    const svc = new WorkflowService(host, new DbWorkflowPersistenceAdapter(db2));
+    const persistence2 = new DbWorkflowPersistenceAdapter(db2);
+    const svc = new WorkflowService(host, persistence2);
     const workflow = this.bindGuardVar(await this.loadWorkflow(), ref.id);
     const externalKey = `${profile.entityPrefix}:${ref.id}`;
     const now2 = new Date().toISOString();
@@ -81963,6 +82452,8 @@ class LifecycleAdapter {
     await svc.reseedRun(workflow, runId, currentStatus);
     const result = await svc.requestTransition(workflow, runId, to, { workdir: this.opts.cwd });
     if (result.allowed) {
+      const terminalStatus = to === "cancelled" ? "failed" : to === "done" ? "done" : null;
+      await persistence2.finalizeRun(runId, terminalStatus ?? "running", new Date().toISOString());
       return { allowed: true, from: result.fromState, to: result.toState };
     }
     return {
@@ -82385,7 +82876,7 @@ var init_progress_follow = __esm(() => {
 });
 
 // ../../packages/app/src/workflow/trace-writer.ts
-import { dirname as dirname18, join as join22 } from "path";
+import { dirname as dirname18, join as join23 } from "path";
 
 class WorkflowTraceWriter {
   path;
@@ -82393,7 +82884,7 @@ class WorkflowTraceWriter {
   pending = Promise.resolve();
   constructor(cwd, runId) {
     const safeRunId = runId.replace(/[^A-Za-z0-9._-]/g, "_");
-    this.path = join22(cwd, ".spur", "runs", "workflow", `${safeRunId}.jsonl`);
+    this.path = join23(cwd, ".spur", "runs", "workflow", `${safeRunId}.jsonl`);
   }
   attach(bus) {
     bus.on("workflow.run.started", (event) => this.enqueue("workflow.run.started", event));
@@ -90010,25 +90501,114 @@ async function attachSystemEventLedger(bus, context4, options = {}) {
   };
 }
 
+// src/commands/shared-options.ts
+var SHARED_OPTIONS = {
+  json: ["--json", "Output machine-readable JSON"],
+  jsonSupported: ["--json", "Output machine-readable JSON where supported"],
+  section: ["--section <name>", "Section name to replace"],
+  fromFile: ["--from-file <path>", "File to read section body from (requires --section)"],
+  statusFilter: ["--status <s>", "Filter by status"],
+  last: ["--last <n>", "Limit results (default 20)"],
+  noSchema: ["--no-schema", "Skip schema validation"],
+  since: ["--since <iso-date>", "Filter runs started on or after this date"],
+  timeout: ["--timeout <ms>", "Caller deadline in milliseconds"],
+  folderTasks: ["--folder <path>", "Custom tasks folder"],
+  folderFeatures: ["--folder <path>", "Custom features folder"],
+  agentIdMessage: ["--agent <id>", "Agent id"],
+  agentIdWatch: ["--agent <id>", "Agent id to watch"],
+  agentIdLegacyRecipient: ["--agent <id>", "Agent spec id / message recipient (legacy \u2014 prefer --spec)"],
+  cwdServe: ["--cwd <path>", "Working directory"],
+  cwdAgent: ["--cwd <path>", "Working directory for agent execution"],
+  modeAgent: ["--mode <mode>", "Agent output mode: text|json"],
+  modeHistory: ["--mode <mode>", "full|incremental|force-file"],
+  nameAgent: ["--name <name>", "Agent name"],
+  nameProjectDisplay: ["--name <name>", "Display name for the project"],
+  nameProjectInit: ["--name <name>", "Project name (default: current directory name)"],
+  pollWorkflow: ["--poll <ms>", "Follow polling interval in milliseconds"],
+  pollAgent: ["--poll <ms>", "Idle poll interval in milliseconds"],
+  portProjects: ["--port <n>", "Explicit port to bind"],
+  portServe: ["--port <n>", "Server port (env: PORT, default: 3000)"],
+  priorityFilter: ["--priority <p>", "Filter by priority"],
+  prioritySet: ["--priority <p>", "Set the priority frontmatter field (P0\u2013P3)"],
+  runHistory: ["--run <runId>", "Narrow to a single workflow run id"],
+  runAgentPin: ["--run <runId>", "Pin a specific run id (default: spec latest run)"],
+  runIdTask: ["--run-id <id>", "Explicit run_id (auto-generated when omitted)"],
+  runIdWorkflow: ["--run-id <id>", "Persisted run id for workflow run"],
+  sourceLink: ["--source <source>", "Link source identifier (e.g. next-auto)"],
+  sourceHistory: [
+    "--source <source>",
+    "pi|claude|codex|gemini|opencode|antigravity|openclaw|omp|grok|agy|all"
+  ],
+  statusDoneFailed: ["--status <status>", "Filter by status: done, failed"],
+  statusDoneFailedRunning: ["--status <status>", "Filter by status: done, failed, running"],
+  untilAgent: ["--until <state>", "Lifecycle state to wait for (repeatable OR)"],
+  untilMessage: ["--until <state>", "Wait target for --wait: injected|invoke-exit"],
+  verboseWorkflow: ["--verbose", "Include transitions and correlation diagnostics in human progress"],
+  verboseRule: ["--verbose", "Stream per-rule progress to stderr"],
+  jsonArtifact: ["--json", "Emit the artifact as JSON instead of the human summary"],
+  jsonDaily: ["--json", "Emit the daily result as JSON"],
+  jsonParsedArtifact: ["--json", "Emit the parsed artifact as JSON instead of the human report"],
+  jsonProjectsArray: ["--json", "Output JSON array of projects"],
+  jsonProjectsResponse: ["--json", "Output JSON response"],
+  jsonMessageStream: ["--json", "Output one JSON object per new message (machine-consumable)"],
+  jsonServePortUrl: ["--json", "Output { port, url, pid } and exit"],
+  fromFileOutcomeRows: ["--from-file <path>", "Path to JSON array of {wbs,outcome[,reason]} rows"],
+  asFeature0418: [
+    "--as <status>",
+    "Evaluate the one-active-goal rule as if the feature were in <status> (0418: lifecycle FSM guards pass the transition target)"
+  ],
+  asTaskF92: [
+    "--as <status>",
+    "Evaluate the task AS if it were in <status> (F92 R2): the lifecycle guards pass the transition target so testing\u2192done checks the done row. Validate against canonical task statuses. Omitted \u2192 current-status diagnostics."
+  ],
+  dryRunFeatureMap: ["--dry-run", "Show the old\u2192new ID map + affected tasks without writing"],
+  dryRunFeatureSync: ["--dry-run", "Report proposed status sync transitions without applying"],
+  dryRunHistoryScan: ["--dry-run", "Scan without persisting imported records"],
+  dryRunRuleFix: ["--dry-run", "Preview fixes without writing (use with --fix-mode auto)"],
+  dryRunTaskReport: ["--dry-run", "Produce the full report without writing files"],
+  dryRunWorkflowValidate: ["--dry-run", "Validate and walk transitions without executing actions"],
+  dryRunWorkflowClean: ["--dry-run", "List what would be cleaned without writing (applies to both scopes)"],
+  featureTrace: ["--feature <id>", "Feature ID for traceability and Goal\u2192Background derivation"],
+  featureFrontmatter: ["--feature <id>", "Set the feature_id frontmatter field (traceability edge)"],
+  featureFilterEdge: ["--feature <id>", "Filter by linked feature ID (feature_id edge)"],
+  featureTasksRewrite: [
+    "--feature <id>",
+    "Restrict the ## Tasks rewrite to one feature (INDEX.md still regenerated)"
+  ],
+  fileHistoryJsonl: ["--file <path>", "Import one JSONL file (single-source only)"],
+  fileRuleAdhoc: ["--file <path>", "Ad-hoc rule file"],
+  fileRuleAdhocPath: ["--file <path>", "Ad-hoc rule file path"],
+  fileTaskBatch: ["--file <path>", "Path to the batch JSON file validated against task-batch.schema.json"],
+  fileTaskTest: ["--file <path>", "Custom target test file path"],
+  forceAgentDelete: ["--force", "Required for delete"],
+  forceFeatureReopen: ["--force", "Force applying reopen proposals without confirmation"],
+  forceInitRecreate: ["--force", "Recreate files that already exist"],
+  forceWorkflowClean: ["--force", "Clean ALL non-terminal runs regardless of age (overrides --older-than)"],
+  strictFeature: ["--strict", "Elevate warnings to failures"],
+  strictTaskAll: ["--strict", "Elevate ALL warnings to failures"],
+  strictTaskPath: ["--strict", "Match only the exact corpus path (no basename-WBS fallback)"]
+};
+var SHARED_OPTION_FLAGS = new Set(Object.values(SHARED_OPTIONS).map(([flags]) => flags));
+
 // src/commands/agent.ts
 function registerAgentCommand(program2, context4) {
   const agent = program2.command("agent").summary("run and inspect supported coding agents");
-  agent.command("list").description("List detected coding agents, or team agent specs with --specs.").option("--json", "Output machine-readable JSON").option("--specs", "List team specs instead of detected agents").action(async (options) => {
+  agent.command("list").description("List detected coding agents, or team agent specs with --specs.").option(...SHARED_OPTIONS.json).option("--specs", "List team specs instead of detected agents").action(async (options) => {
     const svc = new AgentService({ cwd: context4.cwd, env: context4.env, output: context4.output });
     const code = await runAgentList(svc, context4, { json: options.json, specs: options.specs });
     context4.setExitCode(code);
   });
-  agent.command("doctor").description("Check agent readiness.").option("--json", "Output machine-readable JSON").argument("[agent]", "Agent to check").action(async (agentName, options) => {
+  agent.command("doctor").description("Check agent readiness.").option(...SHARED_OPTIONS.json).argument("[agent]", "Agent to check").action(async (agentName, options) => {
     const svc = context4.agentService();
     const code = await svc.doctor({ json: options.json === true, agent: agentName }, undefined);
     context4.setExitCode(code);
   });
-  agent.command("run").description("Execute a prompt or slash command via a coding agent.").option("--agent <name>", "Role, executor, agent binary, auto, or inline (host-session-only; errors on headless surfaces)").option("--spec <id>", "Team agent spec id (occupant addressing; pairs with --drain)").option("--continue", "Resume the previous agent session").option("--model <name>", "Agent model argument").option("--mode <mode>", "Agent output mode: text|json").option("--cwd <path>", "Working directory for agent execution").option("--json", "Output machine-readable JSON where supported").option("--drain", "Prepend pending inbox messages for --spec <id>").argument("<prompt>", "The prompt or slash command to execute").action(async (prompt, options) => {
+  agent.command("run").description("Execute a prompt or slash command via a coding agent.").option("--agent <name>", "Role, executor, agent binary, auto, or inline (host-session-only; errors on headless surfaces)").option("--spec <id>", "Team agent spec id (occupant addressing; pairs with --drain)").option("--continue", "Resume the previous agent session").option("--model <name>", "Agent model argument").option(...SHARED_OPTIONS.modeAgent).option(...SHARED_OPTIONS.cwdAgent).option(...SHARED_OPTIONS.jsonSupported).option("--drain", "Prepend pending inbox messages for --spec <id>").argument("<prompt>", "The prompt or slash command to execute").action(async (prompt, options) => {
     const flags = commanderOptionsToFlags(options);
     const code = await runAgentRun(prompt, context4, flags);
     context4.setExitCode(code);
   });
-  agent.command("loop").description("Run the persistent self-draining loop for a team member (used by the supervisor).").option("--spec <id>", "Agent spec id / message recipient").option("--agent <id>", "Agent spec id / message recipient (legacy \u2014 prefer --spec)").option("--poll <ms>", "Idle poll interval in milliseconds", String(DEFAULT_LOOP_POLL_MS)).action(async (options) => {
+  agent.command("loop").description("Run the persistent self-draining loop for a team member (used by the supervisor).").option("--spec <id>", "Agent spec id / message recipient").option(...SHARED_OPTIONS.agentIdLegacyRecipient).option(...SHARED_OPTIONS.pollAgent, String(DEFAULT_LOOP_POLL_MS)).action(async (options) => {
     const controller = new AbortController;
     const onSignal = () => controller.abort();
     process.on("SIGINT", onSignal);
@@ -90042,11 +90622,11 @@ function registerAgentCommand(program2, context4) {
       process.off("SIGTERM", onSignal);
     }
   });
-  agent.command("wait").description("Wait for a pinned occupant run to reach a lifecycle state (G4 wave 2).").argument("<specId>", "Agent spec id whose occupant to wait on").option("--run <runId>", "Pin a specific run id (default: spec latest run)").option("--until <state>", "Lifecycle state to wait for (repeatable OR)", collectUntil, []).option("--timeout <ms>", "Caller deadline in milliseconds", parseTimeout).option("--json", "Output machine-readable JSON").action(async (specId, options) => {
+  agent.command("wait").description("Wait for a pinned occupant run to reach a lifecycle state (G4 wave 2).").argument("<specId>", "Agent spec id whose occupant to wait on").option(...SHARED_OPTIONS.runAgentPin).option(...SHARED_OPTIONS.untilAgent, collectUntil, []).option(...SHARED_OPTIONS.timeout, parseTimeout).option(...SHARED_OPTIONS.json).action(async (specId, options) => {
     const code = await runAgentWait(context4, specId, options);
     context4.setExitCode(code);
   });
-  agent.command("create").description("Write a team agent spec to .spur/agents/<id>.yaml.").option("--type <agent-type>", "Agent spec type for create").option("--tags <a,b>", "Team identity tags").option("--system-prompt <text>", "Team identity system prompt").option("--name <name>", "Agent name").option("--workspace <path>", "Workspace path").option("--purpose <text>", "Team identity purpose").option("--auto-start", "Auto-start flag").option("--model <name>", "Agent model argument").option("--autonomy <level>", "Autonomy level").option("--no-identity-preamble", "Disable identity preamble").option("--json", "Output machine-readable JSON").argument("<id>", "Agent spec id").action(async (id, options) => {
+  agent.command("create").description("Write a team agent spec to .spur/agents/<id>.yaml.").option("--type <agent-type>", "Agent spec type for create").option("--tags <a,b>", "Team identity tags").option("--system-prompt <text>", "Team identity system prompt").option(...SHARED_OPTIONS.nameAgent).option("--workspace <path>", "Workspace path").option("--purpose <text>", "Team identity purpose").option("--auto-start", "Auto-start flag").option("--model <name>", "Agent model argument").option("--autonomy <level>", "Autonomy level").option("--no-identity-preamble", "Disable identity preamble").option(...SHARED_OPTIONS.json).argument("<id>", "Agent spec id").action(async (id, options) => {
     const flags = commanderOptionsToFlags(options);
     const code = await runAgentCreate(id, context4, flags);
     context4.setExitCode(code);
@@ -90055,7 +90635,7 @@ function registerAgentCommand(program2, context4) {
     const code = await runAgentEdit(id, context4);
     context4.setExitCode(code);
   });
-  agent.command("delete").description("Remove an agent spec.").option("--force", "Required for delete").argument("<id>", "Agent spec id").action(async (id, options) => {
+  agent.command("delete").description("Remove an agent spec.").option(...SHARED_OPTIONS.forceAgentDelete).argument("<id>", "Agent spec id").action(async (id, options) => {
     const flags = commanderOptionsToFlags(options);
     const code = await runAgentDelete(id, context4, flags);
     context4.setExitCode(code);
@@ -90457,6 +91037,533 @@ function waitFail(context4, options, code, message) {
   return 1;
 }
 
+// src/release-ops.ts
+init_dist5();
+import { existsSync as existsSync11, readdirSync as readdirSync7, readFileSync as readFileSync11 } from "fs";
+import { join as join24 } from "path";
+var SEMVER = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z-.]+)?(?:\+[0-9A-Za-z-.]+)?$/;
+function releaseTag(config4, version3) {
+  return `${config4.packageName}${config4.tagVersionSeparator}${version3}`;
+}
+async function run(repoRoot, cmd) {
+  const executor = new NodeProcessExecutor3({ defaultTimeout: 30000, defaultMaxOutput: 512000 });
+  const result = await executor.run({
+    command: cmd[0] ?? "",
+    args: cmd.slice(1),
+    cwd: repoRoot,
+    forceBuffered: true
+  });
+  return {
+    ok: result.exitCode === 0,
+    stdout: result.stdout.toString().trim(),
+    stderr: result.stderr.toString().trim()
+  };
+}
+async function git2(repoRoot, args) {
+  const result = await run(repoRoot, ["git", ...args]);
+  if (!result.ok) {
+    throw new Error(`git ${args.join(" ")} failed: ${result.stderr || result.stdout}`);
+  }
+  return result.stdout;
+}
+async function npmViewVersion(repoRoot, name, version3) {
+  const result = await run(repoRoot, ["npm", "view", `${name}@${version3}`, "version"]);
+  return result.ok && result.stdout === version3;
+}
+async function readJson(path9) {
+  const file2 = Bun.file(path9);
+  if (!await file2.exists())
+    return null;
+  try {
+    const parsed = await file2.json();
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed))
+      return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function rootWorkspaceGlobs(repoRoot) {
+  let root;
+  try {
+    root = JSON.parse(readFileSync11(join24(repoRoot, "package.json"), "utf8"));
+  } catch {
+    return [];
+  }
+  if (root === null || typeof root !== "object")
+    return [];
+  const raw = root.workspaces;
+  const rawPackages = raw.packages;
+  const list = Array.isArray(raw) ? raw : Array.isArray(rawPackages) ? rawPackages : [];
+  return list.filter((g) => typeof g === "string");
+}
+function workspaceDirs(repoRoot) {
+  const dirs = [];
+  for (const glob of rootWorkspaceGlobs(repoRoot)) {
+    if (!glob.endsWith("/*"))
+      continue;
+    const parent = glob.slice(0, -2);
+    const parentAbs = join24(repoRoot, parent);
+    if (!existsSync11(parentAbs))
+      continue;
+    for (const entry of readdirSync7(parentAbs, { withFileTypes: true })) {
+      if (entry.isDirectory() && existsSync11(join24(parentAbs, entry.name, "package.json"))) {
+        dirs.push(`${parent}/${entry.name}`);
+      }
+    }
+  }
+  return dirs;
+}
+async function releaseContext(repoRoot) {
+  const rootManifest = await readJson(join24(repoRoot, "package.json"));
+  if (rootManifest === null) {
+    throw new Error(`no package.json found at ${repoRoot} \u2014 builder operates on a package workspace root.`);
+  }
+  const rootName = typeof rootManifest.name === "string" ? rootManifest.name : "root";
+  const workspaces2 = [];
+  for (const dir of workspaceDirs(repoRoot)) {
+    const manifest = await readJson(join24(repoRoot, dir, "package.json"));
+    if (manifest === null)
+      continue;
+    workspaces2.push({
+      dir,
+      name: typeof manifest.name === "string" ? manifest.name : dir,
+      version: typeof manifest.version === "string" ? manifest.version : "0.0.0",
+      manifest
+    });
+  }
+  const shortName = (name) => name.split("/").pop() ?? name;
+  const packages = new Map;
+  for (const ws of workspaces2) {
+    const versionSourceFile = existsSync11(join24(repoRoot, ws.dir, "src", "config.ts")) ? `${ws.dir}/src/config.ts` : undefined;
+    packages.set(shortName(ws.name), {
+      packageDir: ws.dir,
+      packageName: ws.name,
+      versionSourceFile,
+      tagVersionSeparator: "-v",
+      publishWorkflow: "publish.yml",
+      releaseCommitType: "chore",
+      releaseCommitScope: "release",
+      releaseCommitSubject: (version3) => `bump ${shortName(ws.name)} to ${version3}`,
+      releaseTagMessage: (tag) => `release: ${tag}`,
+      ghRunListLimit: 5
+    });
+  }
+  const pinnedNames = new Set;
+  for (const ws of workspaces2) {
+    for (const field2 of ["dependencies", "devDependencies", "peerDependencies"]) {
+      const deps = ws.manifest[field2];
+      if (deps === null || typeof deps !== "object" || Array.isArray(deps))
+        continue;
+      for (const [dep, spec] of Object.entries(deps)) {
+        if (typeof spec === "string" && spec.startsWith("workspace:") && dep !== ws.name) {
+          pinnedNames.add(dep);
+        }
+      }
+    }
+  }
+  pinnedNames.add(rootName);
+  const allPackages = [...packages.values()].filter((c3) => pinnedNames.has(c3.packageName));
+  return { repoRoot, rootName, packages, allPackages };
+}
+async function updateWorkspacePins(ctx, pkgName, oldVersion, newVersion, output2) {
+  const changed = [];
+  for (const dir of workspaceDirs(ctx.repoRoot)) {
+    const relPath = `${dir}/package.json`;
+    const manifest = await readJson(join24(ctx.repoRoot, relPath));
+    if (manifest === null)
+      continue;
+    let dirty = false;
+    const pin = `workspace:${oldVersion}`;
+    const nextPin = `workspace:${newVersion}`;
+    for (const field2 of ["dependencies", "devDependencies", "peerDependencies"]) {
+      const deps = manifest[field2];
+      if (deps === null || typeof deps !== "object" || Array.isArray(deps))
+        continue;
+      const map2 = deps;
+      if (map2[pkgName] === pin) {
+        map2[pkgName] = nextPin;
+        dirty = true;
+      }
+    }
+    if (dirty) {
+      await Bun.write(join24(ctx.repoRoot, relPath), `${JSON.stringify(manifest, null, 4)}
+`);
+      output2.write(`  \u21B3 ${relPath}: ${pkgName} workspace pin ${oldVersion} \u2192 ${newVersion}`);
+      changed.push(relPath);
+    }
+  }
+  return changed;
+}
+async function updateVersionSourceFile(ctx, filePath, previous, next, output2) {
+  const absPath = join24(ctx.repoRoot, filePath);
+  const content = await Bun.file(absPath).text();
+  const updated = content.replace(/(binaryVersion:\s*['"])\d+\.\d+\.\d+(?:-[0-9A-Za-z-.]+)?(?:\+[0-9A-Za-z-.]+)?(['"])/, `$1${next}$2`);
+  if (updated === content) {
+    output2.write(`  \u26A0 ${filePath}: binaryVersion pattern not found (expected ${previous})`);
+    return false;
+  }
+  await Bun.write(absPath, updated);
+  output2.write(`  \u21B3 ${filePath}: binaryVersion ${previous} \u2192 ${next}`);
+  return true;
+}
+async function syncMarketplaceAndPlugins(ctx, version3, staged, output2) {
+  const marketplacePath = join24(ctx.repoRoot, ".claude-plugin", "marketplace.json");
+  const marketplaceFile = Bun.file(marketplacePath);
+  if (!await marketplaceFile.exists())
+    return;
+  const marketplace = await readJson(marketplacePath);
+  const rawPlugins = marketplace?.plugins;
+  if (marketplace === null || !Array.isArray(rawPlugins))
+    return;
+  const isPlugin = (entry) => entry !== null && typeof entry === "object" && typeof entry.name === "string" && typeof entry.version === "string" && typeof entry.source === "string";
+  const plugins = [];
+  for (const entry of rawPlugins) {
+    if (isPlugin(entry)) {
+      plugins.push({ name: entry.name, version: entry.version, source: entry.source });
+    }
+  }
+  let mpUpdated = false;
+  for (const entry of plugins) {
+    if (entry.version !== version3) {
+      entry.version = version3;
+      mpUpdated = true;
+    }
+  }
+  if (mpUpdated) {
+    marketplace.plugins = plugins;
+    await Bun.write(marketplacePath, `${JSON.stringify(marketplace, null, 4)}
+`);
+    staged.push(".claude-plugin/marketplace.json");
+    output2.write(`Bumped marketplace plugins to ${version3}`);
+  }
+  for (const entry of plugins) {
+    const pluginJsonPath = join24(ctx.repoRoot, entry.source, "plugin.json");
+    const pluginJson = await readJson(pluginJsonPath);
+    if (pluginJson === null) {
+      output2.write(`  \u26A0 plugin.json not found at ${entry.source}/plugin.json \u2014 skipping`);
+      continue;
+    }
+    if (pluginJson.version !== version3) {
+      pluginJson.version = version3;
+      await Bun.write(pluginJsonPath, `${JSON.stringify(pluginJson, null, 4)}
+`);
+      staged.push(`${entry.source}/plugin.json`);
+      output2.write(`Bumped ${entry.source}/plugin.json to ${version3}`);
+    }
+  }
+}
+async function assertCleanTreeOnBranch(ctx) {
+  if (await git2(ctx.repoRoot, ["status", "--porcelain"]) !== "") {
+    throw new Error("working tree is not clean. Commit or stash changes before releasing.");
+  }
+  const branch = await git2(ctx.repoRoot, ["rev-parse", "--abbrev-ref", "HEAD"]);
+  if (branch === "HEAD") {
+    throw new Error("detached HEAD \u2014 checkout a branch before releasing.");
+  }
+  return branch;
+}
+async function assertTagFree(ctx, config4, tag, version3, output2) {
+  const localTags = new Set((await git2(ctx.repoRoot, ["tag", "-l"])).split(`
+`).filter(Boolean));
+  if (localTags.has(tag)) {
+    throw new Error(`tag already exists locally: ${tag}. Run "spur builder drop-tags ${config4.packageName.split("/").pop()} ${version3}" first.`);
+  }
+  const remote = await run(ctx.repoRoot, ["git", "ls-remote", "--tags", "origin"]);
+  if (remote.ok && remote.stdout.includes(`refs/tags/${tag}`)) {
+    throw new Error(`tag already exists on origin: ${tag}. Run "spur builder drop-tags ${config4.packageName.split("/").pop()} ${version3} --remote" first.`);
+  }
+  if (!remote.ok) {
+    output2.write("warning: could not check origin for tag clashes (remote unreachable); continuing.");
+  }
+}
+async function bumpVersion(ctx, config4, version3, options, output2) {
+  if (!SEMVER.test(version3)) {
+    throw new Error(`"${version3}" is not a valid semver version (expected e.g. 0.1.4).`);
+  }
+  const tag = releaseTag(config4, version3);
+  const branch = await assertCleanTreeOnBranch(ctx);
+  await assertTagFree(ctx, config4, tag, version3, output2);
+  if (await npmViewVersion(ctx.repoRoot, config4.packageName, version3)) {
+    throw new Error(`${config4.packageName}@${version3} is already published on npm. Use a new version.`);
+  }
+  const manifestPath = join24(ctx.repoRoot, config4.packageDir, "package.json");
+  const manifest = await readJson(manifestPath);
+  if (manifest === null)
+    throw new Error(`missing or malformed manifest at ${config4.packageDir}/package.json`);
+  const previous = typeof manifest.version === "string" ? manifest.version : "0.0.0";
+  manifest.version = version3;
+  await Bun.write(manifestPath, `${JSON.stringify(manifest, null, 4)}
+`);
+  output2.write(`${config4.packageName}: ${previous} -> ${version3}`);
+  const staged = [`${config4.packageDir}/package.json`];
+  if (config4.versionSourceFile) {
+    const updated = await updateVersionSourceFile(ctx, config4.versionSourceFile, previous, version3, output2);
+    if (updated)
+      staged.push(config4.versionSourceFile);
+  }
+  staged.push(...await updateWorkspacePins(ctx, config4.packageName, previous, version3, output2));
+  await syncMarketplaceAndPlugins(ctx, version3, staged, output2);
+  const lockPath = join24(ctx.repoRoot, "bun.lock");
+  if (existsSync11(lockPath) && Bun.file(lockPath).size > 0)
+    staged.push("bun.lock");
+  await git2(ctx.repoRoot, ["add", ...staged]);
+  const message = `${config4.releaseCommitType}(${config4.releaseCommitScope}): ${config4.releaseCommitSubject(version3)}`;
+  await git2(ctx.repoRoot, ["commit", "-m", message]);
+  output2.write(`Committed: ${message}`);
+  await git2(ctx.repoRoot, ["tag", "-a", tag, "-m", config4.releaseTagMessage(tag)]);
+  output2.write(`Tagged: ${tag}`);
+  if (!options.push) {
+    output2.write(`
+Done (local). Review, then push to release:`);
+    output2.write(`  git push origin ${branch}`);
+    output2.write(`  git push origin ${tag}`);
+    output2.write("Or re-run with --push next time to do this automatically.");
+    return;
+  }
+  output2.write(`
+Pushing branch ${branch} (tags excluded)...`);
+  await git2(ctx.repoRoot, ["push", "origin", branch]);
+  output2.write(`Pushing release trigger tag ${tag}...`);
+  await git2(ctx.repoRoot, ["push", "origin", tag]);
+  output2.write(`
+Released ${version3}. The publish workflow should now be running:`);
+  output2.write(`  gh run list --workflow=${config4.publishWorkflow} --limit ${config4.ghRunListLimit}`);
+}
+async function bumpAll(ctx, version3, options, output2) {
+  if (!SEMVER.test(version3)) {
+    throw new Error(`"${version3}" is not a valid semver version (expected e.g. 0.1.4).`);
+  }
+  if (ctx.allPackages.length === 0) {
+    throw new Error('no workspace packages are pinned via "workspace:" by another package \u2014 nothing to bump.');
+  }
+  const branch = await assertCleanTreeOnBranch(ctx);
+  const configs = ctx.allPackages;
+  const aggregateTag = `${ctx.rootName}-v${version3}`;
+  const existingLocal = new Set((await git2(ctx.repoRoot, ["tag", "-l"])).split(`
+`).filter(Boolean));
+  const allTags = [aggregateTag, ...configs.map((c3) => releaseTag(c3, version3))];
+  for (const tag of allTags) {
+    if (existingLocal.has(tag))
+      throw new Error(`tag already exists locally: ${tag}`);
+  }
+  const remoteRefs = await git2(ctx.repoRoot, ["ls-remote", "--tags", "origin"]);
+  for (const tag of allTags) {
+    if (remoteRefs.includes(`refs/tags/${tag}`)) {
+      throw new Error(`tag already exists on origin: ${tag}. Run "spur builder drop-tags --all ${version3} --remote" first.`);
+    }
+  }
+  for (const config4 of configs) {
+    if (await npmViewVersion(ctx.repoRoot, config4.packageName, version3)) {
+      throw new Error(`${config4.packageName}@${version3} is already published on npm. Use a new version.`);
+    }
+  }
+  const staged = [];
+  for (const config4 of configs) {
+    const manifestPath = join24(ctx.repoRoot, config4.packageDir, "package.json");
+    const manifest = await readJson(manifestPath);
+    if (manifest === null) {
+      throw new Error(`missing or malformed manifest at ${config4.packageDir}/package.json`);
+    }
+    const previous = typeof manifest.version === "string" ? manifest.version : "0.0.0";
+    manifest.version = version3;
+    await Bun.write(manifestPath, `${JSON.stringify(manifest, null, 4)}
+`);
+    output2.write(`${config4.packageName}: ${previous} -> ${version3}`);
+    staged.push(`${config4.packageDir}/package.json`);
+    if (config4.versionSourceFile) {
+      const updated = await updateVersionSourceFile(ctx, config4.versionSourceFile, previous, version3, output2);
+      if (updated)
+        staged.push(config4.versionSourceFile);
+    }
+    staged.push(...await updateWorkspacePins(ctx, config4.packageName, previous, version3, output2));
+  }
+  await syncMarketplaceAndPlugins(ctx, version3, staged, output2);
+  const lockPath = join24(ctx.repoRoot, "bun.lock");
+  if (existsSync11(lockPath) && Bun.file(lockPath).size > 0)
+    staged.push("bun.lock");
+  await git2(ctx.repoRoot, ["add", ...staged]);
+  const shortNames = configs.map((c3) => c3.packageName.split("/").pop() ?? c3.packageName).join(" + ");
+  const message = `chore(release): bump ${shortNames} to ${version3}`;
+  await git2(ctx.repoRoot, ["commit", "-m", message]);
+  output2.write(`Committed: ${message}`);
+  for (const config4 of configs) {
+    const tag = releaseTag(config4, version3);
+    if (tag !== aggregateTag) {
+      await git2(ctx.repoRoot, ["tag", "-a", tag, "-m", config4.releaseTagMessage(tag)]);
+      output2.write(`Tagged (trace): ${tag}`);
+    }
+  }
+  await git2(ctx.repoRoot, ["tag", "-a", aggregateTag, "-m", `${ctx.rootName} ${version3} \u2014 ${shortNames}`]);
+  output2.write(`Tagged (publish): ${aggregateTag}`);
+  if (!options.push) {
+    output2.write(`
+Done (local). Review, then push to release:`);
+    output2.write(`  git push origin ${branch}`);
+    output2.write(`  git push origin ${aggregateTag}`);
+    output2.write("Or re-run with --push next time to do this automatically.");
+    return;
+  }
+  output2.write(`
+Pushing branch ${branch} (tags excluded)...`);
+  await git2(ctx.repoRoot, ["push", "origin", branch]);
+  output2.write(`Pushing release trigger tag ${aggregateTag}...`);
+  await git2(ctx.repoRoot, ["push", "origin", aggregateTag]);
+  output2.write(`
+Released ${version3}. The publish workflow should now be running:`);
+  output2.write("  gh run list --workflow=publish.yml --limit 3");
+}
+async function dropTagsFor(ctx, config4, version3, options, output2) {
+  if (!SEMVER.test(version3)) {
+    throw new Error(`"${version3}" is not a valid semver version (expected e.g. 0.1.2).`);
+  }
+  const tag = releaseTag(config4, version3);
+  const localTags = new Set((await git2(ctx.repoRoot, ["tag", "-l"])).split(`
+`).filter(Boolean));
+  if (localTags.has(tag)) {
+    await git2(ctx.repoRoot, ["tag", "-d", tag]);
+    output2.write(`Deleted local tag ${tag}`);
+  } else {
+    output2.write(`No local tag ${tag}`);
+  }
+  if (options.remote) {
+    const result = await run(ctx.repoRoot, ["git", "push", "origin", `:refs/tags/${tag}`]);
+    output2.write(result.ok ? `Deleted remote tag ${tag}` : `Remote tag ${tag} not present or already removed`);
+  }
+}
+async function dropAll(ctx, version3, options, output2) {
+  if (!SEMVER.test(version3)) {
+    throw new Error(`"${version3}" is not a valid semver version (expected e.g. 0.1.2).`);
+  }
+  for (const config4 of ctx.allPackages) {
+    await dropTagsFor(ctx, config4, version3, options, output2);
+  }
+  const aggregateTag = `${ctx.rootName}-v${version3}`;
+  const localTags = new Set((await git2(ctx.repoRoot, ["tag", "-l"])).split(`
+`).filter(Boolean));
+  if (localTags.has(aggregateTag)) {
+    await git2(ctx.repoRoot, ["tag", "-d", aggregateTag]);
+    output2.write(`Deleted local tag ${aggregateTag}`);
+  }
+  if (options.remote) {
+    const result = await run(ctx.repoRoot, ["git", "push", "origin", `:refs/tags/${aggregateTag}`]);
+    output2.write(result.ok ? `Deleted remote tag ${aggregateTag}` : `Remote tag ${aggregateTag} not present or already removed`);
+  }
+}
+function releaseUsage(message) {
+  const usage = [
+    "Usage:",
+    "  bump-ver <version> | bump-ver --all <version> [--push]    bump all released packages",
+    "  bump-ver <package-id> <version> [--push]                 bump one package, commit, tag",
+    "  drop-tags <version> | drop-tags --all <version> [--remote]  drop all release tags",
+    "  drop-tags <package-id> <version> [--remote]              drop one package release tag"
+  ].join(`
+`);
+  return new Error(message === undefined ? usage : `${message}
+
+${usage}`);
+}
+async function bumpVer(args, repoRoot = process.cwd(), output2 = consoleOutput) {
+  const ctx = await releaseContext(repoRoot);
+  const positional = args.filter((arg) => !arg.startsWith("--"));
+  if (args.includes("--all") || positional.length === 1 && SEMVER.test(positional[0] ?? "")) {
+    const allVersion = positional[0];
+    if (!allVersion)
+      throw releaseUsage("bump-ver [--all] <version> [--push]");
+    await bumpAll(ctx, allVersion, { push: args.includes("--push") }, output2);
+    return;
+  }
+  const packageId = positional[0];
+  const version3 = positional[1];
+  if (!packageId || !version3)
+    throw releaseUsage("bump-ver <version> | bump-ver <package-id> <version> [--push]");
+  const config4 = ctx.packages.get(packageId);
+  if (config4 === undefined) {
+    throw releaseUsage(`unknown package "${packageId}". Package IDs: ${[...ctx.packages.keys()].join(", ")}`);
+  }
+  await bumpVersion(ctx, config4, version3, { push: args.includes("--push") }, output2);
+}
+async function dropTags(args, repoRoot = process.cwd(), output2 = consoleOutput) {
+  const ctx = await releaseContext(repoRoot);
+  const positional = args.filter((arg) => !arg.startsWith("--"));
+  if (args.includes("--all") || positional.length === 1 && SEMVER.test(positional[0] ?? "")) {
+    const allVersion = positional[0];
+    if (!allVersion)
+      throw releaseUsage("drop-tags [--all] <version> [--remote]");
+    await dropAll(ctx, allVersion, { remote: args.includes("--remote") }, output2);
+    return;
+  }
+  const packageId = positional[0];
+  const version3 = positional[1];
+  if (!packageId || !version3) {
+    throw releaseUsage("drop-tags <version> | drop-tags <package-id> <version> [--remote]");
+  }
+  const config4 = ctx.packages.get(packageId);
+  if (config4 === undefined) {
+    throw releaseUsage(`unknown package "${packageId}". Package IDs: ${[...ctx.packages.keys()].join(", ")}`);
+  }
+  await dropTagsFor(ctx, config4, version3, { remote: args.includes("--remote") }, output2);
+}
+
+// src/commands/builder.ts
+function registerBuilderCommand(program2, context4) {
+  const noun = program2.command("builder").summary("release plumbing: version bumps and release tags");
+  noun.command("bump-ver").summary("bump a package version, commit, tag, optionally push").description([
+    "Bump one workspace package (or every released package with --all),",
+    "rewrite workspace pins, commit, and tag. A bare version bumps all:",
+    "  spur builder bump-ver 0.1.4          # every released package",
+    "  spur builder bump-ver spur 0.1.4     # one package by id"
+  ].join(`
+`)).option("--all", "bump every released package in one commit with per-package + aggregate tags").option("--push", "push the branch and release tag to origin").option(...SHARED_OPTIONS.json).argument("[target]", "package id, or the version itself when bumping all").argument("[version]", "target semver version").action(async (target, version3, options) => {
+    const args = [target, version3].filter((value) => value !== undefined);
+    if (options.all === true)
+      args.push("--all");
+    if (options.push === true)
+      args.push("--push");
+    try {
+      await bumpVer(args, context4.cwd, context4.output);
+      if (options.json === true) {
+        context4.output.write(toJson2({ ok: true, verb: "bump-ver", target: target ?? "all", version: version3 ?? "" }));
+      }
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      if (options.json === true) {
+        context4.output.write(toJson2({ ok: false, verb: "bump-ver", error: message }));
+        context4.setExitCode(1);
+        return;
+      }
+      context4.output.error(message);
+      context4.setExitCode(1);
+    }
+  });
+  noun.command("drop-tags").summary("delete release tags locally and optionally on origin").description([
+    "Delete one package release tag (or every released tag plus the aggregate",
+    "with --all / a bare version). Use --remote to also delete on origin."
+  ].join(`
+`)).option("--all", "drop every released tag plus the aggregate tag").option("--remote", "also delete the tag(s) on origin").option(...SHARED_OPTIONS.json).argument("[target]", "package id, or the version itself when dropping all").argument("[version]", "semver version of the tags to drop").action(async (target, version3, options) => {
+    const args = [target, version3].filter((value) => value !== undefined);
+    if (options.all === true)
+      args.push("--all");
+    if (options.remote === true)
+      args.push("--remote");
+    try {
+      await dropTags(args, context4.cwd, context4.output);
+      if (options.json === true) {
+        context4.output.write(toJson2({ ok: true, verb: "drop-tags", target: target ?? "all", version: version3 ?? "" }));
+      }
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      if (options.json === true) {
+        context4.output.write(toJson2({ ok: false, verb: "drop-tags", error: message }));
+        context4.setExitCode(1);
+        return;
+      }
+      context4.output.error(message);
+      context4.setExitCode(1);
+    }
+  });
+}
+
 // src/commands/feature.ts
 await init_src3();
 
@@ -90489,14 +91596,14 @@ function makePlanningEmitter(context4) {
 init_loader();
 init_src2();
 await init_src3();
-import { existsSync as existsSync10 } from "fs";
+import { existsSync as existsSync12 } from "fs";
 import { homedir as homedir8 } from "os";
-import { join as join23, resolve as resolve16 } from "path";
+import { join as join25, resolve as resolve16 } from "path";
 
 // src/workflow/resolve-spur-bin.ts
-import { basename as basename7 } from "path";
+import { basename as basename8 } from "path";
 function resolveSpurBinFrom(launch) {
-  const runtime = basename7(launch.execPath).toLowerCase().replace(/\.exe$/, "");
+  const runtime = basename8(launch.execPath).toLowerCase().replace(/\.exe$/, "");
   const isJsRuntime = runtime === "bun" || runtime === "node";
   if (isJsRuntime && launch.mainModule) {
     return `${launch.execPath} ${launch.mainModule}`;
@@ -90509,23 +91616,23 @@ function resolveSpurBin() {
 }
 
 // src/workflow/make-lifecycle-adapter.ts
-var GLOBAL_CONFIG_DIR = join23(".config", "spur");
+var GLOBAL_CONFIG_DIR = join25(".config", "spur");
 function globalConfigRoot(context4) {
   const override = context4.env.SPUR_GLOBAL_RULES_DIR;
-  return override !== undefined && override.length > 0 ? resolve16(context4.cwd, override) : join23(homedir8(), GLOBAL_CONFIG_DIR);
+  return override !== undefined && override.length > 0 ? resolve16(context4.cwd, override) : join25(homedir8(), GLOBAL_CONFIG_DIR);
 }
 function resolveWorkflowPath(context4, profile) {
   const bundledRoot = bundledConfigRoot();
   if (bundledRoot !== null) {
-    const bundledPath = join23(bundledRoot, "workflows", `${profile.workflowName}.yaml`);
-    if (existsSync10(bundledPath))
+    const bundledPath = join25(bundledRoot, "workflows", `${profile.workflowName}.yaml`);
+    if (existsSync12(bundledPath))
       return bundledPath;
   }
-  const projectPath = join23(context4.cwd, ".spur", "workflows", `${profile.workflowName}.yaml`);
-  if (existsSync10(projectPath))
+  const projectPath = join25(context4.cwd, ".spur", "workflows", `${profile.workflowName}.yaml`);
+  if (existsSync12(projectPath))
     return projectPath;
-  const globalPath = join23(globalConfigRoot(context4), "workflows", `${profile.workflowName}.yaml`);
-  if (existsSync10(globalPath))
+  const globalPath = join25(globalConfigRoot(context4), "workflows", `${profile.workflowName}.yaml`);
+  if (existsSync12(globalPath))
     return globalPath;
   return null;
 }
@@ -90547,7 +91654,7 @@ function makeLifecycleAdapter(context4, profile) {
 // src/commands/feature.ts
 function registerFeatureCommand(program2, context4) {
   const feature = program2.command("feature").summary("manage features (hierarchical IDs)");
-  feature.command("create").summary("Create a feature; allocates a hierarchical ID (DD-14) under the create-lock.").argument("<name>", "Feature name").option("--parent <id>", "Parent feature ID (child gets the next free digit 1-9)").option("--folder <path>", "Custom features folder").option("--json", "Output machine-readable JSON").action(async (name, options) => {
+  feature.command("create").summary("Create a feature; allocates a hierarchical ID (DD-14) under the create-lock.").argument("<name>", "Feature name").option("--parent <id>", "Parent feature ID (child gets the next free digit 1-9)").option(...SHARED_OPTIONS.folderFeatures).option(...SHARED_OPTIONS.json).action(async (name, options) => {
     const svc = await makeService(context4, options.folder);
     try {
       const result = await svc.create(name, options.parent);
@@ -90561,7 +91668,7 @@ function registerFeatureCommand(program2, context4) {
       context4.setExitCode(1);
     }
   });
-  feature.command("show").alias("get").summary("Show a feature by ID.").argument("<id>", "Feature ID").option("--folder <path>", "Custom features folder").option("--json", "Output machine-readable JSON").action(async (id, options) => {
+  feature.command("show").alias("get").summary("Show a feature by ID.").argument("<id>", "Feature ID").option(...SHARED_OPTIONS.folderFeatures).option(...SHARED_OPTIONS.json).action(async (id, options) => {
     const svc = await makeService(context4, options.folder);
     try {
       const result = await svc.show(id);
@@ -90586,7 +91693,7 @@ function registerFeatureCommand(program2, context4) {
     "`--section` costs a failed write. List valid names first:",
     "`spur task sections <wbs> list`."
   ].join(`
-`)).option("--field <key>", "Frontmatter field to set (e.g. priority)").option("--value <value>", "New value for --field").option("--section <name>", "Section name to replace").option("--from-file <path>", "File to read section body from (requires --section)").option("--folder <path>", "Custom features folder").option("--json", "Output machine-readable JSON").action(async (id, status, options) => {
+`)).option("--field <key>", "Frontmatter field to set (e.g. priority)").option("--value <value>", "New value for --field").option(...SHARED_OPTIONS.section).option(...SHARED_OPTIONS.fromFile).option(...SHARED_OPTIONS.folderFeatures).option(...SHARED_OPTIONS.json).action(async (id, status, options) => {
     const svc = await makeService(context4, options.folder);
     try {
       let result;
@@ -90642,7 +91749,7 @@ function registerFeatureCommand(program2, context4) {
       context4.setExitCode(1);
     }
   });
-  feature.command("advance").summary("Walk a feature through the legal forward lifecycle path.").argument("<id>", "Feature ID to advance").option("--to <status>", "Target status (default: 'done')").option("--folder <path>", "Custom features folder").option("--json", "Output machine-readable JSON").action(async (id, options) => {
+  feature.command("advance").summary("Walk a feature through the legal forward lifecycle path.").argument("<id>", "Feature ID to advance").option("--to <status>", "Target status (default: 'done')").option(...SHARED_OPTIONS.folderFeatures).option(...SHARED_OPTIONS.json).action(async (id, options) => {
     const svc = await makeService(context4, options.folder);
     const target = options.to ?? "done";
     const forwardPath = {
@@ -90701,7 +91808,7 @@ function registerFeatureCommand(program2, context4) {
       context4.setExitCode(1);
     }
   });
-  feature.command("list").summary("List features with optional status/priority filters.").option("--status <s>", "Filter by status").option("--priority <p>", "Filter by priority").option("--folder <path>", "Custom features folder").option("--json", "Output machine-readable JSON").action(async (options) => {
+  feature.command("list").summary("List features with optional status/priority filters.").option(...SHARED_OPTIONS.statusFilter).option(...SHARED_OPTIONS.priorityFilter).option(...SHARED_OPTIONS.folderFeatures).option(...SHARED_OPTIONS.json).action(async (options) => {
     const svc = await makeService(context4, options.folder);
     try {
       let features = await svc.list();
@@ -90726,7 +91833,7 @@ function registerFeatureCommand(program2, context4) {
       context4.setExitCode(1);
     }
   });
-  feature.command("move").summary("Move a feature to a new parent \u2014 cascade rename of the subtree (DD-14).").argument("<id>", "Feature ID to move").option("--parent <id>", "New parent feature ID (omit to move to a top-level group)").option("--dry-run", "Show the old\u2192new ID map + affected tasks without writing").option("--folder <path>", "Custom features folder").option("--json", "Output machine-readable JSON").action(async (id, options) => {
+  feature.command("move").summary("Move a feature to a new parent \u2014 cascade rename of the subtree (DD-14).").argument("<id>", "Feature ID to move").option("--parent <id>", "New parent feature ID (omit to move to a top-level group)").option(...SHARED_OPTIONS.dryRunFeatureMap).option(...SHARED_OPTIONS.folderFeatures).option(...SHARED_OPTIONS.json).action(async (id, options) => {
     const svc = await makeService(context4, options.folder);
     try {
       const result = await svc.move(id, options.parent ?? null, { dryRun: options.dryRun === true });
@@ -90754,7 +91861,7 @@ function registerFeatureCommand(program2, context4) {
     "Does NOT change feature frontmatter status. For lifecycle alignment use `spur feature sync`.",
     "Use after task create/link/done when the ## Tasks table is stale."
   ].join(`
-`)).option("--feature <id>", "Restrict the ## Tasks rewrite to one feature (INDEX.md still regenerated)").option("--folder <path>", "Custom features folder").option("--json", "Output machine-readable JSON").action(async (options) => {
+`)).option(...SHARED_OPTIONS.featureTasksRewrite).option(...SHARED_OPTIONS.folderFeatures).option(...SHARED_OPTIONS.json).action(async (options) => {
     const svc = await makeService(context4, options.folder);
     try {
       const result = await svc.refresh({ featureId: options.feature });
@@ -90770,7 +91877,7 @@ function registerFeatureCommand(program2, context4) {
       context4.setExitCode(1);
     }
   });
-  feature.command("check").summary("Validate feature file(s) through the four-layer check (design \xA73).").argument("[id]", "Feature ID (validates all features in the folder when omitted)").option("--strict", "Elevate warnings to failures").option("--as <status>", "Evaluate the one-active-goal rule as if the feature were in <status> (0418: lifecycle FSM guards pass the transition target)").option("--folder <path>", "Custom features folder").option("--json", "Output machine-readable JSON").action(async (id, options) => {
+  feature.command("check").summary("Validate feature file(s) through the four-layer check (design \xA73).").argument("[id]", "Feature ID (validates all features in the folder when omitted)").option(...SHARED_OPTIONS.strictFeature).option(...SHARED_OPTIONS.asFeature0418).option(...SHARED_OPTIONS.folderFeatures).option("--fix", "repair structural findings in place (heading presence/level/order, R-item checkboxes)").option(...SHARED_OPTIONS.json).action(async (id, options) => {
     const resolved = await resolvePlanningFolders(context4.fs);
     const featuresDir = options.folder ?? context4.fs.resolve(resolved.featuresDir);
     const tasksDir = context4.fs.resolve(resolved.tasksDir);
@@ -90798,10 +91905,16 @@ function registerFeatureCommand(program2, context4) {
           tasksDirs,
           runDir: context4.fs.resolve(".spur/run"),
           severityOverrides: resolved.severityOverrides,
-          asStatus: options.as
+          asStatus: options.as,
+          fix: options.fix === true
         });
         results.push(result);
         if (!json3) {
+          if (result.repairs !== undefined && result.repairs.length > 0) {
+            for (const r of result.repairs) {
+              context4.output.write(`  [FIX] ${r.kind} ${r.section}: ${r.detail}`);
+            }
+          }
           context4.output.write(`
 ${result.id} (${result.status}): ${result.pass ? "PASS" : "FAIL"}`);
           for (const f of result.findings) {
@@ -90829,7 +91942,7 @@ ${result.id} (${result.status}): ${result.pass ? "PASS" : "FAIL"}`);
     "",
     "Does NOT rewrite INDEX.md or ## Tasks tables. For stale rosters use `spur feature refresh`."
   ].join(`
-`)).argument("[id]", "Feature ID to sync (optional if --all is passed)").option("--all", "Sync all features with linked tasks").option("--dry-run", "Report proposed status sync transitions without applying").option("--force", "Force applying reopen proposals without confirmation").option("--folder <path>", "Custom features folder").option("--json", "Output machine-readable JSON").action(async (id, options) => {
+`)).argument("[id]", "Feature ID to sync (optional if --all is passed)").option("--all", "Sync all features with linked tasks").option(...SHARED_OPTIONS.dryRunFeatureSync).option(...SHARED_OPTIONS.forceFeatureReopen).option(...SHARED_OPTIONS.folderFeatures).option(...SHARED_OPTIONS.json).action(async (id, options) => {
     const svc = await makeService(context4, options.folder);
     try {
       if (!options.all && !id) {
@@ -90922,7 +92035,7 @@ import { createRequire } from "module";
 var CLI_CONFIG = {
   binaryName: "spur",
   binaryLabel: "spur",
-  binaryVersion: "0.3.55",
+  binaryVersion: "0.3.57",
   configDir: ".spur",
   configFile: ".spur/config.yaml",
   databaseFile: ".spur/spur.db"
@@ -90949,7 +92062,7 @@ importer: @gobing-ai/ts-llm-jsonl-importer@${provenance.importer}`;
 function registerHistoryCommand(program2, context4) {
   const noun = program2.command("history").summary("import and analyze coding-agent history");
   const makeService2 = () => new HistoryService({ getDb: () => context4.getDb(), agentConfig: context4.agentConfig });
-  noun.command("import").description("Import agent conversation JSONL. `--source all` fans out across all sources with " + "per-source failure isolation (task 0470). A single source is the n=1 case of " + "the same contract \u2014 never two import paths.").option("--source <source>", "pi|claude|codex|gemini|opencode|antigravity|openclaw|omp|grok|agy|all", "all").option("--file <path>", "Import one JSONL file (single-source only)").option("--root <path>", "Scan a history root").option("--mode <mode>", "full|incremental|force-file").option("--dry-run", "Scan without persisting imported records").option("--source-timeout <ms>", "Per-source timeout in milliseconds (default 600000 = 10 min)", "600000").option("--json", "Output machine-readable JSON where supported").action(async (options) => {
+  noun.command("import").description("Import agent conversation JSONL. `--source all` fans out across all sources with " + "per-source failure isolation (task 0470). A single source is the n=1 case of " + "the same contract \u2014 never two import paths.").option(...SHARED_OPTIONS.sourceHistory, "all").option(...SHARED_OPTIONS.fileHistoryJsonl).option("--root <path>", "Scan a history root").option(...SHARED_OPTIONS.modeHistory).option(...SHARED_OPTIONS.dryRunHistoryScan).option("--source-timeout <ms>", "Per-source timeout in milliseconds (default 600000 = 10 min)", "600000").option(...SHARED_OPTIONS.jsonSupported).action(async (options) => {
     const source = options.source ?? "all";
     if (options.file && source === "all") {
       context4.output.write(options.json ? toJson2({ status: "error", message: '--file requires a single --source, not "all".' }) : 'spur history import: --file requires a single --source, not "all".');
@@ -90988,7 +92101,7 @@ function registerHistoryCommand(program2, context4) {
 ${formatFanOutResult(fanOut)}`);
     context4.setExitCode(fanOut.exitCode);
   });
-  noun.command("analyze").description("Aggregate imported history with SQL and write a versioned JSON artifact (Q1-Q10 forensic query set).").option("--since <iso>", "Inclusive lower bound on message timestamp").option("--until <iso>", "Inclusive upper bound on message timestamp").option("--source <source>", "pi|claude|codex|gemini|opencode|antigravity|openclaw|omp|grok|agy|all", "all").option("--session <id>", "Narrow to a single session id").option("--run <runId>", "Narrow to a single workflow run id").option("--task <wbs>", "Narrow to a single task WBS").option("--top <n>", "Leaderboard depth for byTool/bySession", "20").option("--out <path>", "Write the artifact to this path instead of the dated reports dir").option("--json", "Emit the artifact as JSON instead of the human summary").action(async (options) => {
+  noun.command("analyze").description("Aggregate imported history with SQL and write a versioned JSON artifact (Q1-Q10 forensic query set).").option("--since <iso>", "Inclusive lower bound on message timestamp").option("--until <iso>", "Inclusive upper bound on message timestamp").option(...SHARED_OPTIONS.sourceHistory, "all").option("--session <id>", "Narrow to a single session id").option(...SHARED_OPTIONS.runHistory).option("--task <wbs>", "Narrow to a single task WBS").option("--top <n>", "Leaderboard depth for byTool/bySession", "20").option("--out <path>", "Write the artifact to this path instead of the dated reports dir").option(...SHARED_OPTIONS.jsonArtifact).action(async (options) => {
     const svc = makeService2();
     const source = options.source ?? "all";
     const selector = {
@@ -91012,7 +92125,7 @@ ${formatFanOutResult(fanOut)}`);
       daily: artifact.daily
     }));
   });
-  noun.command("report").description("Render a previously-generated history artifact as a spend + forensic report. " + "Never opens the database \u2014 pure renderer of the analyze JSON. " + "--task / --top narrow the already-loaded artifact client-side (0564 R3).").argument("[path]", "Artifact JSON path (defaults to the latest.json pointer)").option("--json", "Emit the parsed artifact as JSON instead of the human report").option("--mode <name>", "Report mode: default | forensics (registry-resolved; unknown names fail)").option("--task <wbs>", "Narrow to a single task WBS the artifact was analyzed with").option("--top <n>", "Leaderboard depth for byTool/bySession (re-slices the artifact)").action(async (pathArg, options) => {
+  noun.command("report").description("Render a previously-generated history artifact as a spend + forensic report. " + "Never opens the database \u2014 pure renderer of the analyze JSON. " + "--task / --top narrow the already-loaded artifact client-side (0564 R3).").argument("[path]", "Artifact JSON path (defaults to the latest.json pointer)").option(...SHARED_OPTIONS.jsonParsedArtifact).option("--mode <name>", "Report mode: default | forensics (registry-resolved; unknown names fail)").option("--task <wbs>", "Narrow to a single task WBS the artifact was analyzed with").option("--top <n>", "Leaderboard depth for byTool/bySession (re-slices the artifact)").action(async (pathArg, options) => {
     try {
       const top = parseTopOrThrow(options.top);
       const { report, artifactPath, resolution, artifact, banner } = runHistoryReport({
@@ -91047,7 +92160,7 @@ ${formatFanOutResult(fanOut)}`);
       context4.setExitCode(1);
     }
   });
-  noun.command("daily").description("Run-once daily pipeline: import-all (fan-out, per-source isolation) \u2192 analyze \u2192 write " + "artifact \u2192 prune reports older than 90 days (task 0470 R6). Import uses checkpoint " + "resume, so a missed night self-heals on the next run with no gap and no double-count.").option("--since <iso>", "Inclusive lower bound on message timestamp for the report (not the import)").option("--until <iso>", "Inclusive upper bound on message timestamp for the report").option("--source-timeout <ms>", "Per-source import timeout in milliseconds (default 600000 = 10 min)", "600000").option("--root <path>", "History root override (default: per-source platform dir)").option("--json", "Emit the daily result as JSON").option("--mode <name>", "Render the artifact as a .md sidecar in this mode after analyze (e.g. forensics)").action(async (options) => {
+  noun.command("daily").description("Run-once daily pipeline: import-all (fan-out, per-source isolation) \u2192 analyze \u2192 write " + "artifact \u2192 prune reports older than 90 days (task 0470 R6). Import uses checkpoint " + "resume, so a missed night self-heals on the next run with no gap and no double-count.").option("--since <iso>", "Inclusive lower bound on message timestamp for the report (not the import)").option("--until <iso>", "Inclusive upper bound on message timestamp for the report").option("--source-timeout <ms>", "Per-source import timeout in milliseconds (default 600000 = 10 min)", "600000").option("--root <path>", "History root override (default: per-source platform dir)").option(...SHARED_OPTIONS.jsonDaily).option("--mode <name>", "Render the artifact as a .md sidecar in this mode after analyze (e.g. forensics)").action(async (options) => {
     const svc = makeService2();
     const sourceTimeout = Number.parseInt(options.sourceTimeout ?? "600000", 10) || 600000;
     const bus = new EventBus;
@@ -91160,7 +92273,7 @@ function parseTopOrThrow(raw) {
 function formatFanOutResult(r) {
   const lines = ["history import (fan-out)", "sources:"];
   for (const e of r.entries) {
-    lines.push(`  ${e.source}: ${e.status} (files=${e.files} messages=${e.messages})`);
+    lines.push(`  ${e.source}: ${e.status} (files=${e.files} scanned, new-messages=${e.messages}, tool-calls=${e.toolCalls})`);
   }
   if (r.warnings.length > 0) {
     lines.push("warnings:");
@@ -91176,7 +92289,7 @@ function formatDailyResult(r) {
   const lines = ["history daily"];
   lines.push("import:");
   for (const e of r.fanOut.entries) {
-    lines.push(`  ${e.source}: ${e.status} (files=${e.files} messages=${e.messages})`);
+    lines.push(`  ${e.source}: ${e.status} (files=${e.files} scanned, new-messages=${e.messages}, tool-calls=${e.toolCalls})`);
   }
   if (r.fanOut.warnings.length > 0) {
     lines.push("warnings:");
@@ -91200,7 +92313,7 @@ init_loader();
 init_src2();
 init_dist10();
 import { homedir as homedir9 } from "os";
-import { join as join24, resolve as resolve17 } from "path";
+import { join as join26, resolve as resolve17 } from "path";
 
 // src/config/scaffold-manifest.ts
 var SCAFFOLD_MANIFEST = [
@@ -91247,8 +92360,8 @@ var SCAFFOLD_MANIFEST = [
 ];
 
 // src/commands/init.ts
-var GLOBAL_CONFIG_DIR2 = join24(".config", "spur");
-var GLOBAL_RULES_DIR2 = join24(GLOBAL_CONFIG_DIR2, "rules");
+var GLOBAL_CONFIG_DIR2 = join26(".config", "spur");
+var GLOBAL_RULES_DIR2 = join26(GLOBAL_CONFIG_DIR2, "rules");
 var GLOBAL_CONFIG_EXAMPLE = "config.example.yaml";
 var GLOBAL_CONFIG_FILE2 = "config.yaml";
 var INDEXED_CONTEXT_MARKER = "## Indexed context";
@@ -91279,7 +92392,7 @@ If \`.spur/context/\` is absent, proceed normally. Never block work on its absen
 `;
 function globalRulesRoot(context4) {
   const override = context4.env.SPUR_GLOBAL_RULES_DIR;
-  return override !== undefined && override.length > 0 ? resolve17(context4.cwd, override) : join24(homedir9(), GLOBAL_RULES_DIR2);
+  return override !== undefined && override.length > 0 ? resolve17(context4.cwd, override) : join26(homedir9(), GLOBAL_RULES_DIR2);
 }
 async function writeIfNew(context4, path9, content, force, result) {
   if (!force && await context4.fs.exists(path9)) {
@@ -91296,11 +92409,11 @@ async function seedGlobalRules(context4) {
   const target = globalRulesRoot(context4);
   let written = 0;
   for (const relPath of await listBundledRuleFiles()) {
-    const destination = join24(target, relPath);
+    const destination = join26(target, relPath);
     if (await context4.fs.exists(destination))
       continue;
-    await context4.fs.ensureDir(join24(target, ...relPath.split("/").slice(0, -1)));
-    await context4.fs.writeFile(destination, await context4.fs.readFile(join24(source, relPath)));
+    await context4.fs.ensureDir(join26(target, ...relPath.split("/").slice(0, -1)));
+    await context4.fs.writeFile(destination, await context4.fs.readFile(join26(source, relPath)));
     written += 1;
   }
   return written;
@@ -91310,20 +92423,20 @@ async function seedGlobalConfig(context4) {
   if (source === null)
     return 0;
   const globalOverride = context4.env.SPUR_GLOBAL_RULES_DIR;
-  const target = globalOverride !== undefined && globalOverride.length > 0 ? resolve17(context4.cwd, globalOverride) : join24(homedir9(), GLOBAL_CONFIG_DIR2);
+  const target = globalOverride !== undefined && globalOverride.length > 0 ? resolve17(context4.cwd, globalOverride) : join26(homedir9(), GLOBAL_CONFIG_DIR2);
   let written = 0;
   for (const relPath of listBundledConfigFiles()) {
     if (relPath === GLOBAL_CONFIG_EXAMPLE)
       continue;
-    const destination = join24(target, relPath);
+    const destination = join26(target, relPath);
     if (await context4.fs.exists(destination))
       continue;
-    await context4.fs.ensureDir(join24(target, ...relPath.split("/").slice(0, -1)));
-    await context4.fs.writeFile(destination, await context4.fs.readFile(join24(source, relPath)));
+    await context4.fs.ensureDir(join26(target, ...relPath.split("/").slice(0, -1)));
+    await context4.fs.writeFile(destination, await context4.fs.readFile(join26(source, relPath)));
     written += 1;
   }
-  const examplePath = join24(source, GLOBAL_CONFIG_EXAMPLE);
-  const globalConfigPath = join24(target, GLOBAL_CONFIG_FILE2);
+  const examplePath = join26(source, GLOBAL_CONFIG_EXAMPLE);
+  const globalConfigPath = join26(target, GLOBAL_CONFIG_FILE2);
   if (await context4.fs.exists(examplePath) && !await context4.fs.exists(globalConfigPath)) {
     await context4.fs.ensureDir(target);
     await context4.fs.writeFile(globalConfigPath, await context4.fs.readFile(examplePath));
@@ -91331,13 +92444,13 @@ async function seedGlobalConfig(context4) {
   }
   return written;
 }
-function registerInitCommand(program2, context4) {
-  program2.command("init").summary("scaffold a local Spur project").option("--name <name>", "Project name (default: current directory name)").option("--force", "Recreate files that already exist").option("--minimal", "Only write the minimal .spur scaffold").option("--json", "Output machine-readable JSON").action(async (options) => {
-    const json3 = options.json === true;
-    const force = options.force === true;
-    const minimal = options.minimal === true;
-    const projectName = options.name ?? "default";
-    const configPath = join24(context4.cwd, CLI_CONFIG.configFile);
+function registerInitCommand(program2, context4, options = {}) {
+  program2.command("init", { hidden: options.hidden === true }).summary("scaffold a local Spur project").option(...SHARED_OPTIONS.nameProjectInit).option(...SHARED_OPTIONS.forceInitRecreate).option("--minimal", "Only write the minimal .spur scaffold").option(...SHARED_OPTIONS.json).action(async (options2) => {
+    const json3 = options2.json === true;
+    const force = options2.force === true;
+    const minimal = options2.minimal === true;
+    const projectName = options2.name ?? "default";
+    const configPath = join26(context4.cwd, CLI_CONFIG.configFile);
     if (!force && await context4.fs.exists(configPath)) {
       const message = `Already initialized: ${CLI_CONFIG.configFile}. Use --force to overwrite.`;
       context4.output.write(json3 ? toJson2({ ok: false, reason: "already-initialized", config: CLI_CONFIG.configFile }) : message);
@@ -91372,13 +92485,13 @@ function registerInitCommand(program2, context4) {
     ].join(`
 `)}
 `;
-    await context4.fs.ensureDir(join24(context4.cwd, CLI_CONFIG.configDir));
+    await context4.fs.ensureDir(join26(context4.cwd, CLI_CONFIG.configDir));
     await context4.fs.writeFile(configPath, configYaml);
     result.created.push(configPath);
-    const agentsDir = join24(context4.cwd, CLI_CONFIG.configDir, "agents");
+    const agentsDir = join26(context4.cwd, CLI_CONFIG.configDir, "agents");
     await context4.fs.ensureDir(agentsDir);
-    await writeIfNew(context4, join24(agentsDir, ".gitkeep"), "", force, result);
-    const gitignorePath = join24(context4.cwd, ".gitignore");
+    await writeIfNew(context4, join26(agentsDir, ".gitkeep"), "", force, result);
+    const gitignorePath = join26(context4.cwd, ".gitignore");
     const contextEntry = ".spur/context/";
     if (await context4.fs.exists(gitignorePath)) {
       const existing = await context4.fs.readFile(gitignorePath);
@@ -91400,20 +92513,20 @@ ${contextEntry}
         for (const relPath of listBundledProjectSeedFiles()) {
           if (relPath.startsWith("templates/docs/"))
             continue;
-          const sourcePath = join24(configRoot, relPath);
+          const sourcePath = join26(configRoot, relPath);
           if (!await context4.fs.exists(sourcePath))
             continue;
-          const targetPath = join24(context4.cwd, CLI_CONFIG.configDir, relPath);
-          await context4.fs.ensureDir(join24(targetPath, ".."));
+          const targetPath = join26(context4.cwd, CLI_CONFIG.configDir, relPath);
+          await context4.fs.ensureDir(join26(targetPath, ".."));
           await writeIfNew(context4, targetPath, await context4.fs.readFile(sourcePath), force, result);
         }
         for (const entry of SCAFFOLD_MANIFEST) {
-          const sourcePath = join24(configRoot, entry.source);
+          const sourcePath = join26(configRoot, entry.source);
           if (!await context4.fs.exists(sourcePath))
             continue;
-          const baseDir = entry.root === true ? context4.cwd : join24(context4.cwd, CLI_CONFIG.configDir);
-          const targetPath = join24(baseDir, entry.target);
-          await context4.fs.ensureDir(join24(targetPath, ".."));
+          const baseDir = entry.root === true ? context4.cwd : join26(context4.cwd, CLI_CONFIG.configDir);
+          const targetPath = join26(baseDir, entry.target);
+          await context4.fs.ensureDir(join26(targetPath, ".."));
           const entryForce = entry.preserve === true ? false : force;
           let body = await context4.fs.readFile(sourcePath);
           if (entry.target === "AGENTS.md") {
@@ -91426,7 +92539,7 @@ ${contextEntry}
         }
       }
     }
-    const agentsMdPath = join24(context4.cwd, "AGENTS.md");
+    const agentsMdPath = join26(context4.cwd, "AGENTS.md");
     if (await context4.fs.exists(agentsMdPath)) {
       const existing = await context4.fs.readFile(agentsMdPath);
       if (!existing.includes(INDEXED_CONTEXT_MARKER)) {
@@ -91471,22 +92584,22 @@ var DEFAULT_FROM = "operator";
 var DEFAULT_WATCH_INTERVAL_MS = 2000;
 function registerMessageCommand(program2, context4) {
   const noun = program2.command("message").summary("send and inspect durable inter-agent messages");
-  noun.command("send").description("Enqueue a message for an agent. Use --wait to block until the recipient reaches a state.").argument("<body>", "Message body").requiredOption("--to <id>", "Recipient agent id").option("--from <id>", "Sender id", DEFAULT_FROM).option("--wait", "Block until the recipient occupant reaches --until (default: invoke-exit)").option("--until <state>", "Wait target for --wait: injected|invoke-exit", collectSendUntil, []).option("--timeout <ms>", "Caller deadline in milliseconds", parseTimeout2).option("--json", "Output machine-readable JSON").action(async (body, options) => {
+  noun.command("send").description("Enqueue a message for an agent. Use --wait to block until the recipient reaches a state.").argument("<body>", "Message body").requiredOption("--to <id>", "Recipient agent id").option("--from <id>", "Sender id", DEFAULT_FROM).option("--wait", "Block until the recipient occupant reaches --until (default: invoke-exit)").option(...SHARED_OPTIONS.untilMessage, collectSendUntil, []).option(...SHARED_OPTIONS.timeout, parseTimeout2).option(...SHARED_OPTIONS.json).action(async (body, options) => {
     const svc = new TeamService(context4);
     const code = await runMessageSend(svc, context4, body, options);
     context4.setExitCode(code);
   });
-  noun.command("inbox").description("List messages addressed to an agent.").requiredOption("--agent <id>", "Agent id").option("--json", "Output machine-readable JSON").action(async (options) => {
+  noun.command("inbox").description("List messages addressed to an agent.").requiredOption(...SHARED_OPTIONS.agentIdMessage).option(...SHARED_OPTIONS.json).action(async (options) => {
     const svc = new TeamService(context4);
     const code = await runMessageInbox(svc, context4, options);
     context4.setExitCode(code);
   });
-  noun.command("reply").description("Thread a reply to a message.").argument("<msg-id>", "Message id to reply to").argument("<body>", "Reply body").option("--json", "Output machine-readable JSON").action(async (msgId, body, options) => {
+  noun.command("reply").description("Thread a reply to a message.").argument("<msg-id>", "Message id to reply to").argument("<body>", "Reply body").option(...SHARED_OPTIONS.json).action(async (msgId, body, options) => {
     const svc = new TeamService(context4);
     const code = await runMessageReply(svc, context4, msgId, body, options);
     context4.setExitCode(code);
   });
-  noun.command("watch").description("Follow an agent inbox \u2014 surface new messages as they arrive (Ctrl-C to exit).").requiredOption("--agent <id>", "Agent id to watch").option("--interval <ms>", "Poll interval in milliseconds", String(DEFAULT_WATCH_INTERVAL_MS)).option("--json", "Output one JSON object per new message (machine-consumable)").action(async (options) => {
+  noun.command("watch").description("Follow an agent inbox \u2014 surface new messages as they arrive (Ctrl-C to exit).").requiredOption(...SHARED_OPTIONS.agentIdWatch).option("--interval <ms>", "Poll interval in milliseconds", String(DEFAULT_WATCH_INTERVAL_MS)).option(...SHARED_OPTIONS.jsonMessageStream).action(async (options) => {
     const svc = new TeamService(context4);
     const intervalMs = parseInterval2(options.interval);
     if (intervalMs === null) {
@@ -91769,31 +92882,31 @@ async function waitForPendingDrain(agentService, teamService, pin, timeoutMs, si
 
 // src/commands/migrate.ts
 init_src2();
-import { join as join25 } from "path";
-function registerMigrateCommand(program2, context4) {
-  program2.command("migrate").summary("apply CLI-owned schema migrations").option("--json", "Output machine-readable JSON").action(async (options) => {
-    const migrations = await loadSqlMigrations(join25(context4.cwd, "drizzle")).catch(() => {
+import { join as join27 } from "path";
+function registerMigrateCommand(program2, context4, options = {}) {
+  program2.command("migrate", { hidden: options.hidden === true }).summary("apply CLI-owned schema migrations").option(...SHARED_OPTIONS.json).action(async (options2) => {
+    const migrations = await loadSqlMigrations(join27(context4.cwd, "drizzle")).catch(() => {
       return;
     });
     const applied = await applyCliMigrations(await context4.getDb(), migrations);
     const result = { ok: true, applied };
-    context4.output.write(options.json === true ? toJson2(result) : `Database migrations complete (${applied} applied)`);
+    context4.output.write(options2.json === true ? toJson2(result) : `Database migrations complete (${applied} applied)`);
   });
 }
 
 // src/commands/projects.ts
 init_dist5();
 await init_src3();
-import { basename as basename8, resolve as resolve18 } from "path";
+import { basename as basename9, resolve as resolve18 } from "path";
 function registerProjectsCommand(program2, context4) {
   const projectsCmd = program2.command("projects").summary("manage the Spur multi-project registry");
-  projectsCmd.command("add").argument("<path>", "Project root directory path").option("--name <name>", "Display name for the project").option("--json", "Output JSON response").action(async (pathArg, options) => {
+  projectsCmd.command("add").argument("<path>", "Project root directory path").option(...SHARED_OPTIONS.nameProjectDisplay).option(...SHARED_OPTIONS.jsonProjectsResponse).action(async (pathArg, options) => {
     try {
       const absolutePath = resolve18(context4.cwd, pathArg);
       if (!await context4.fs.exists(absolutePath)) {
         throw new Error(`Directory does not exist: ${absolutePath}`);
       }
-      const name = options.name ?? basename8(absolutePath);
+      const name = options.name ?? basename9(absolutePath);
       const registry2 = new ProjectRegistry;
       const entry = await registry2.upsert({ path: absolutePath, name, port: 0 });
       if (options.json) {
@@ -91811,7 +92924,7 @@ function registerProjectsCommand(program2, context4) {
       context4.setExitCode(1);
     }
   });
-  projectsCmd.command("remove").argument("<target>", "Project display name or directory path").option("--json", "Output JSON response").action(async (target, options) => {
+  projectsCmd.command("remove").argument("<target>", "Project display name or directory path").option(...SHARED_OPTIONS.jsonProjectsResponse).action(async (target, options) => {
     try {
       const registry2 = new ProjectRegistry;
       const removed = await registry2.remove(target);
@@ -91833,7 +92946,7 @@ function registerProjectsCommand(program2, context4) {
       context4.setExitCode(1);
     }
   });
-  projectsCmd.command("list").option("--json", "Output JSON array of projects").action(async (options) => {
+  projectsCmd.command("list").option(...SHARED_OPTIONS.jsonProjectsArray).action(async (options) => {
     try {
       const registry2 = new ProjectRegistry;
       const rawProjects = await registry2.list();
@@ -91865,7 +92978,7 @@ function registerProjectsCommand(program2, context4) {
       context4.setExitCode(1);
     }
   });
-  projectsCmd.command("start").argument("<target>", "Project display name or path").option("--port <n>", "Explicit port to bind", parseInt).option("--json", "Output JSON response").action(async (target, options) => {
+  projectsCmd.command("start").argument("<target>", "Project display name or path").option(...SHARED_OPTIONS.portProjects, parseInt).option(...SHARED_OPTIONS.jsonProjectsResponse).action(async (target, options) => {
     try {
       const registry2 = new ProjectRegistry;
       const result = await startRegisteredProject(registry2, target, {
@@ -91898,7 +93011,7 @@ function registerProjectsCommand(program2, context4) {
       context4.setExitCode(1);
     }
   });
-  projectsCmd.command("stop").argument("<target>", "Project display name or path").option("--json", "Output JSON response").action(async (target, options) => {
+  projectsCmd.command("stop").argument("<target>", "Project display name or path").option(...SHARED_OPTIONS.jsonProjectsResponse).action(async (target, options) => {
     try {
       const registry2 = new ProjectRegistry;
       const entry = await registry2.getByName(target) ?? await registry2.getByPath(target);
@@ -91981,7 +93094,7 @@ function shouldColor(env, stream) {
 // src/commands/rule.ts
 function registerRuleCommand(program2, context4) {
   const rule = program2.command("rule").summary("manage constraint rules and presets");
-  rule.command("run").summary("Evaluate constraint rules over the working tree.").option("--preset <name>", "Preset to load (default: recommended-pre-check)", "recommended-pre-check").option("--file <path>", "Ad-hoc rule file").option("--rule <id>", "Filter run to one rule ID").option("--fail-on <severity>", "Exit 1 threshold: error|warning|info (default: error)", "error").option("--stop-on-first [severity]", "Stop evaluation after first rule with findings at/above severity").option("--fix-mode <mode>", "Fix collection/apply mode: none|suggest|auto (default: none)", "none").option("--dry-run", "Preview fixes without writing (use with --fix-mode auto)").option("--verbose", "Stream per-rule progress to stderr").option("--json", "Output machine-readable JSON").action(async (options) => {
+  rule.command("run").summary("Evaluate constraint rules over the working tree.").option("--preset <name>", "Preset to load (default: recommended-pre-check)", "recommended-pre-check").option(...SHARED_OPTIONS.fileRuleAdhoc).option("--rule <id>", "Filter run to one rule ID").option("--fail-on <severity>", "Exit 1 threshold: error|warning|info (default: error)", "error").option("--stop-on-first [severity]", "Stop evaluation after first rule with findings at/above severity").option("--fix-mode <mode>", "Fix collection/apply mode: none|suggest|auto (default: none)", "none").option(...SHARED_OPTIONS.dryRunRuleFix).option(...SHARED_OPTIONS.verboseRule).option(...SHARED_OPTIONS.json).action(async (options) => {
     const service = new RuleService(context4);
     const preset = options.preset ?? "recommended-pre-check";
     const failOn = parseFailOn(options.failOn ?? "error");
@@ -92008,7 +93121,7 @@ function registerRuleCommand(program2, context4) {
     });
     context4.setExitCode(result.exitCode);
   });
-  rule.command("validate").summary("Validate a rule file or preset without evaluating it.").argument("[file-or-preset]", "File path or preset name to validate").option("--file <path>", "Ad-hoc rule file path").option("--preset <name>", "Preset name").option("--kind <type>", "Source kind: file or preset").option("--no-schema", "Skip schema validation").option("--json", "Output machine-readable JSON").action(async (fileOrPreset, options) => {
+  rule.command("validate").summary("Validate a rule file or preset without evaluating it.").argument("[file-or-preset]", "File path or preset name to validate").option(...SHARED_OPTIONS.fileRuleAdhocPath).option("--preset <name>", "Preset name").option("--kind <type>", "Source kind: file or preset").option(...SHARED_OPTIONS.noSchema).option(...SHARED_OPTIONS.json).action(async (fileOrPreset, options) => {
     const service = new RuleService(context4);
     const source = resolveSource({ file: options.file, preset: options.preset }, fileOrPreset ? [fileOrPreset] : []);
     if (options.kind && (options.kind === "file" || options.kind === "preset")) {
@@ -92019,13 +93132,13 @@ function registerRuleCommand(program2, context4) {
     const result = await service.validate({ source, json: json3, validateSchema });
     context4.setExitCode(result.exitCode);
   });
-  rule.command("list").summary("List discovered rule files, or list resolved rules for a preset.").option("--preset <name>", "Preset to list rules for").option("--json", "Output machine-readable JSON").action(async (options) => {
+  rule.command("list").summary("List discovered rule files, or list resolved rules for a preset.").option("--preset <name>", "Preset to list rules for").option(...SHARED_OPTIONS.json).action(async (options) => {
     const service = new RuleService(context4);
     const preset = options.preset;
     const result = await service.list(preset);
     context4.output.write(options.json ? JSON.stringify(result, null, 2) : preset === undefined ? formatRuleFileList(result) : formatPresetRuleList(result));
   });
-  rule.command("trace").summary("Show persisted rule run history.").argument("[run-id]", "Run ID for per-run detail").option("--preset <name>", "Filter by preset name").option("--status <status>", "Filter by status: done, failed").option("--since <iso-date>", "Filter runs started on or after this date").option("--last <n>", "Limit results (default 20)", "20").option("--json", "Output machine-readable JSON").action(async (runId, options) => {
+  rule.command("trace").summary("Show persisted rule run history.").argument("[run-id]", "Run ID for per-run detail").option("--preset <name>", "Filter by preset name").option(...SHARED_OPTIONS.statusDoneFailed).option(...SHARED_OPTIONS.since).option(...SHARED_OPTIONS.last, "20").option(...SHARED_OPTIONS.json).action(async (runId, options) => {
     const last = parseInt(options.last, 10);
     if (!Number.isInteger(last) || last < 1) {
       context4.output.error("--last must be a positive integer");
@@ -92210,7 +93323,7 @@ function formatTraceDetail(detail) {
 
 // src/commands/serve.ts
 init_src();
-import { join as join29 } from "path";
+import { join as join31 } from "path";
 
 // ../server/src/index.ts
 init_src();
@@ -92220,11 +93333,11 @@ init_src();
 init_loader();
 init_src2();
 await init_src3();
-import { basename as basename10, dirname as dirname20, isAbsolute as isAbsolute6, join as join28 } from "path";
+import { basename as basename11, dirname as dirname20, isAbsolute as isAbsolute6, join as join30 } from "path";
 init_dist5();
 
 // ../server/src/bootstrap.ts
-import { join as join26 } from "path";
+import { join as join28 } from "path";
 
 // ../../node_modules/.bun/radash@12.1.1/node_modules/radash/dist/esm/async.mjs
 var guard = (func, shouldGuard) => {
@@ -98393,7 +99506,7 @@ var featureModule = {
 
 // ../server/src/modules/health/index.ts
 await init_src3();
-import { basename as basename9 } from "path";
+import { basename as basename10 } from "path";
 var startedAt = Date.now();
 var healthModule = {
   name: "health",
@@ -98419,7 +99532,7 @@ var healthModule = {
       return c3.json({ status: "error", db: "unreachable" }, 503);
     });
     app.get("/api/project", (c3) => {
-      return c3.json({ name: ctx ? basename9(ctx.cwd) : null });
+      return c3.json({ name: ctx ? basename10(ctx.cwd) : null });
     });
     app.get("/api/projects", async (c3) => {
       if (!ctx) {
@@ -101159,7 +102272,7 @@ function createApp(appRt, opts) {
     app.use("*", async (c3, next) => {
       const pathname = c3.req.path === "/" ? "/index.html" : c3.req.path;
       try {
-        const file2 = Bun.file(join26(webDistPath, pathname));
+        const file2 = Bun.file(join28(webDistPath, pathname));
         if (await file2.exists()) {
           const headers = new Headers({ "content-type": file2.type });
           return new Response(file2.stream(), { headers });
@@ -101172,7 +102285,7 @@ function createApp(appRt, opts) {
         return c3.json({ error: "Not Found" }, 404);
       }
       try {
-        const indexFile = Bun.file(join26(webDistPath, "index.html"));
+        const indexFile = Bun.file(join28(webDistPath, "index.html"));
         if (await indexFile.exists()) {
           return new Response(indexFile.stream(), {
             headers: { "content-type": "text/html; charset=utf-8" }
@@ -101193,7 +102306,7 @@ init_src();
 init_src2();
 init_dist5();
 await init_src3();
-import { dirname as dirname19, join as join27 } from "path";
+import { dirname as dirname19, join as join29 } from "path";
 var NOOP_OUTPUT = { write: (_s) => {}, error: (_s) => {} };
 
 class LazyPlanningEventEmitter {
@@ -101228,7 +102341,7 @@ class NotConfiguredError extends Error {
 function createServerContext(appRt, options) {
   const cwd = options.cwd;
   const fs3 = options.fs;
-  const dbUrl = options.dbUrl ?? join27(cwd, DEFAULT_DATABASE_URL);
+  const dbUrl = options.dbUrl ?? join29(cwd, DEFAULT_DATABASE_URL);
   const eventsBus = options.eventsBus ?? appRt.events;
   const jobQueueEnabled = options.jobQueueEnabled ?? false;
   const eventProjectContext = systemEventProjectContext(cwd);
@@ -101479,7 +102592,7 @@ async function loadServerSectionMatrix() {
   }
   const root = bundledConfigRoot();
   if (root !== null) {
-    const matrixPath = join28(root, "tasks", "section-matrix.yaml");
+    const matrixPath = join30(root, "tasks", "section-matrix.yaml");
     if (await nodeFs.exists(matrixPath)) {
       return await loadStructuredSpurConfig(matrixPath, {
         validateJsonSchema: false
@@ -101488,7 +102601,7 @@ async function loadServerSectionMatrix() {
   }
   throw new Error(`no canonical section-matrix found for task creation (F92 R1); tried:
 ` + `  - ${localPath}
-` + (root !== null ? `  - ${join28(root, "tasks", "section-matrix.yaml")}
+` + (root !== null ? `  - ${join30(root, "tasks", "section-matrix.yaml")}
 ` : "") + "copy/generate section-matrix.yaml from the canonical build-time matrix asset (repo `config` `tasks` tree) into one of those paths");
 }
 var SYSTEM_EVENTS_PRUNE_JOB = "system-events-prune";
@@ -101623,15 +102736,15 @@ async function handleFeatureActionJob(ctx, env, payload) {
   await runFeatureActionJob(ctx, env, payload);
 }
 async function resolveWebDistPath(configuredPath) {
-  const candidates = configuredPath && configuredPath.trim() !== "" ? [isAbsolute6(configuredPath) ? configuredPath : join28(process.cwd(), configuredPath)] : [
-    join28(process.cwd(), "dist/web"),
-    join28(import.meta.dir, "web"),
-    join28(dirname20(process.execPath), "web"),
-    join28(dirname20(process.execPath), "../web"),
-    join28(import.meta.dir, "../../../dist/web")
+  const candidates = configuredPath && configuredPath.trim() !== "" ? [isAbsolute6(configuredPath) ? configuredPath : join30(process.cwd(), configuredPath)] : [
+    join30(process.cwd(), "dist/web"),
+    join30(import.meta.dir, "web"),
+    join30(dirname20(process.execPath), "web"),
+    join30(dirname20(process.execPath), "../web"),
+    join30(import.meta.dir, "../../../dist/web")
   ];
   for (const candidate of candidates) {
-    if (await Bun.file(join28(candidate, "index.html")).exists()) {
+    if (await Bun.file(join30(candidate, "index.html")).exists()) {
       return candidate;
     }
   }
@@ -101736,7 +102849,7 @@ async function startServer(options, deps = defaultDeps) {
       });
       const projectRegistry = new ProjectRegistry;
       const projectCwd = process.cwd();
-      const projectName = basename10(projectCwd);
+      const projectName = basename11(projectCwd);
       try {
         await projectRegistry.upsert({ path: projectCwd, name: projectName, port: server.port });
       } catch (err) {
@@ -101798,18 +102911,18 @@ if (false) {}
 
 // src/commands/serve.ts
 function resolveServeDbUrl(cwd, env, configuredUrl) {
-  return env.DATABASE_URL === undefined ? join29(cwd, DEFAULT_DATABASE_URL) : configuredUrl;
+  return env.DATABASE_URL === undefined ? join31(cwd, DEFAULT_DATABASE_URL) : configuredUrl;
 }
-function registerServeCommand(program2, context4) {
-  program2.command("serve").summary("start the Spur web server (local fallback)").option("--port <n>", "Server port (env: PORT, default: 3000)", parseInt).option("--host <addr>", "Bind address (env: HOST, default: localhost)").option("--no-open", "Skip opening the browser").option("--cwd <path>", "Working directory", context4.cwd).option("--json", "Output { port, url, pid } and exit").action(async (options) => {
+function registerServeCommand(program2, context4, options = {}) {
+  program2.command("serve", { hidden: options.hidden === true }).summary("start the Spur web server (local fallback)").option(...SHARED_OPTIONS.portServe, parseInt).option("--host <addr>", "Bind address (env: HOST, default: localhost)").option("--no-open", "Skip opening the browser").option(...SHARED_OPTIONS.cwdServe, context4.cwd).option(...SHARED_OPTIONS.jsonServePortUrl).action(async (options2) => {
     try {
       const env = process.env;
       const config4 = buildConfigFromEnv(env);
-      const port = options.port ?? config4.server.port;
-      const host = options.host ?? config4.server.host;
-      const cwd = options.cwd ?? context4.cwd;
+      const port = options2.port ?? config4.server.port;
+      const host = options2.host ?? config4.server.host;
+      const cwd = options2.cwd ?? context4.cwd;
       const dbUrl = resolveServeDbUrl(cwd, env, config4.database.url);
-      if (options.json) {
+      if (options2.json) {
         context4.output.write(toJson2({
           port,
           url: `http://${host}:${port}`,
@@ -101823,7 +102936,7 @@ function registerServeCommand(program2, context4) {
         port,
         host,
         dbUrl,
-        openBrowser: options.open ?? true,
+        openBrowser: options2.open ?? true,
         webDistPath: config4.server.webDistPath
       });
     } catch (err) {
@@ -101837,7 +102950,7 @@ function registerServeCommand(program2, context4) {
 }
 
 // src/commands/status.ts
-import { join as join30 } from "path";
+import { join as join32 } from "path";
 
 // src/errors.ts
 class CommandError extends Error {
@@ -101895,10 +103008,10 @@ async function gitContext(cwd) {
 }
 
 // src/commands/status.ts
-function registerStatusCommand(program2, context4) {
-  program2.command("status").summary("show project, Git, and optional path status").option("--json", "Output machine-readable JSON").argument("[path]", "Optional file/dir path to check").action(async (path9, options) => {
+function registerStatusCommand(program2, context4, options = {}) {
+  program2.command("status", { hidden: options.hidden === true }).summary("show project, Git, and optional path status").option(...SHARED_OPTIONS.json).argument("[path]", "Optional file/dir path to check").action(async (path9, options2) => {
     try {
-      const code = await runStatusCore(path9, options, context4);
+      const code = await runStatusCore(path9, options2, context4);
       context4.setExitCode(code);
     } catch (err) {
       context4.output.error(err instanceof Error ? err.message : String(err));
@@ -101907,9 +103020,9 @@ function registerStatusCommand(program2, context4) {
   });
 }
 async function runStatusCore(path9, options, context4) {
-  const [packageJsonExists, spurConfigExists, git2, agentSpecs] = await Promise.all([
-    context4.fs.exists(join30(context4.cwd, "package.json")),
-    context4.fs.exists(join30(context4.cwd, ".spur", "config.yaml")),
+  const [packageJsonExists, spurConfigExists, git3, agentSpecs] = await Promise.all([
+    context4.fs.exists(join32(context4.cwd, "package.json")),
+    context4.fs.exists(join32(context4.cwd, ".spur", "config.yaml")),
     gitContext(context4.cwd),
     listAgentSpecIds(context4)
   ]);
@@ -101918,7 +103031,7 @@ async function runStatusCore(path9, options, context4) {
     ok: spurConfigExists,
     packageJson: packageJsonExists,
     spurConfig: spurConfigExists,
-    git: git2,
+    git: git3,
     agentSpecs,
     ...target === undefined ? {} : { target }
   };
@@ -101929,7 +103042,7 @@ async function runStatusCore(path9, options, context4) {
       `Project: ${spurConfigExists ? "ok" : "missing .spur/config.yaml"}`,
       `Package: ${packageJsonExists ? "ok" : "none"}`,
       `Agents: ${agentSpecs.length === 0 ? "none" : agentSpecs.join(", ")}`,
-      `Git: ${git2.root === null ? "none" : `${git2.branch ?? "detached"}${git2.dirty ? " dirty" : " clean"}`}`,
+      `Git: ${git3.root === null ? "none" : `${git3.branch ?? "detached"}${git3.dirty ? " dirty" : " clean"}`}`,
       ...target === undefined ? [] : [`Path: ${target.path}	${target.size} bytes`]
     ].join(`
 `));
@@ -101937,14 +103050,14 @@ async function runStatusCore(path9, options, context4) {
   return status.ok ? 0 : 1;
 }
 async function listAgentSpecIds(context4) {
-  const dir = join30(context4.cwd, ".spur", "agents");
+  const dir = join32(context4.cwd, ".spur", "agents");
   if (!await context4.fs.exists(dir))
     return [];
   const entries = await context4.fs.readDir(dir);
   return entries.filter((entry) => entry.endsWith(".yaml") || entry.endsWith(".yml")).map((entry) => entry.replace(/\.ya?ml$/, "")).sort();
 }
 async function readTargetStatus(context4, targetPath) {
-  const resolved = join30(context4.cwd, targetPath);
+  const resolved = join32(context4.cwd, targetPath);
   const stat = await context4.fs.stat(resolved);
   if (stat === null)
     throw new CommandError(`status failed: path does not exist at ${resolved}`);
@@ -101956,8 +103069,8 @@ init_loader();
 init_src2();
 init_dist5();
 await init_src3();
-import { existsSync as existsSync11, readFileSync as readFileSync10 } from "fs";
-import { dirname as dirname21, join as join31 } from "path";
+import { existsSync as existsSync13, readFileSync as readFileSync12 } from "fs";
+import { dirname as dirname21, join as join33 } from "path";
 // schemas/section-matrix.schema.json
 var section_matrix_schema_default = {
   $schema: "http://json-schema.org/draft-07/schema#",
@@ -102861,7 +103974,7 @@ function renderMigrationReport(report, dryRun, corpusDir) {
 }
 function registerTaskCommand(program2, context4) {
   const task = program2.command("task").summary("manage tasks");
-  task.command("create").summary("Create a new task with race-safe WBS allocation.").argument("<title>", "Task title").option("--feature <id>", "Feature ID for traceability and Goal\u2192Background derivation").option("--parent <wbs>", "Parent WBS for sub-task grouping").option("--template <variant>", `Template variant (${TASK_VARIANTS.join("|")})`).option("--folder <path>", "Custom tasks folder").option("--dedupe-within <seconds>", "Override the default dedup window (seconds). Guard is on (300s) by default when --feature is set.", Number).option("--allow-duplicate-name", "Disable the dedup guard entirely (creates anyway)").option("--json", "Output machine-readable JSON").action(async (title2, options) => {
+  task.command("create").summary("Create a new task with race-safe WBS allocation.").argument("<title>", "Task title").option(...SHARED_OPTIONS.featureTrace).option("--parent <wbs>", "Parent WBS for sub-task grouping").option("--template <variant>", `Template variant (${TASK_VARIANTS.join("|")})`).option(...SHARED_OPTIONS.folderTasks).option("--dedupe-within <seconds>", "Override the default dedup window (seconds). Guard is on (300s) by default when --feature is set.", Number).option("--allow-duplicate-name", "Disable the dedup guard entirely (creates anyway)").option(...SHARED_OPTIONS.json).action(async (title2, options) => {
     if (options.template !== undefined && !TASK_VARIANTS.includes(options.template)) {
       context4.output.error(`Unknown template variant "${options.template}". Valid: ${TASK_VARIANTS.join(", ")}`);
       context4.setExitCode(2);
@@ -102925,7 +104038,7 @@ function registerTaskCommand(program2, context4) {
       }
     }
   });
-  task.command("show").alias("get").summary("Show a task by WBS.").argument("<wbs>", "Task WBS number").option("--folder <path>", "Custom tasks folder").option("--json", "Output machine-readable JSON").action(async (wbs, options) => {
+  task.command("show").alias("get").summary("Show a task by WBS.").argument("<wbs>", "Task WBS number").option(...SHARED_OPTIONS.folderTasks).option(...SHARED_OPTIONS.json).action(async (wbs, options) => {
     const svc = await makeService2(context4, options.folder);
     try {
       const result = await svc.show(wbs);
@@ -102953,7 +104066,7 @@ ${result.content}`);
     "See the gate checklist (spur-dev/references/gate-checklists.md).",
     "Valid section names (no failed write): `spur task sections <wbs> list`."
   ].join(`
-`)).option("--section <name>", "Section name to replace").option("--from-file <path>", "File to read section body from (requires --section)").option("--feature <id>", "Set the feature_id frontmatter field (traceability edge)").option("--priority <p>", "Set the priority frontmatter field (P0\u2013P3)").option("--ac-numbering <mode>", "Set the ac_numbering frontmatter field (task-local) \u2014 opts the task into the Requirements\u2194AC coverage check").option("--ac-altitude <mode>", "Set the ac_altitude frontmatter field. Valid: `graduating` (default; feature-AC subset rule enforced) or `task-local` (skip the DD-09 subset rule \u2014 task scenarios are intentionally not feature ship criteria). Mirrors the L1 schema enum (packages/domain/src/planning/schema.ts:304).").option("--no-lifecycle", "Suppress lifecycle workflow run creation (use during pipeline runs to avoid orphaned lifecycle runs)").option("--force-done", "Allow transitioning to `done` even when the verify verdict is not PASS; records an override (task 0292). Waives the verdict only \u2014 the FSM path still applies, so from an earlier status walk the hops first: `todo` \u2192 `wip` \u2192 `testing` \u2192 `done` (each hop runs the structural `spur task check`)").option("--reason <text>", "Rationale for a forced-done override (paired with --force-done; persisted as done_reason)").option("--verdict-dir <path>", "Directory holding <wbs>-verdict.json artifacts (default: .spur/run)").option("--folder <path>", "Custom tasks folder").option("--json", "Output machine-readable JSON").action(async (wbs, status, options) => {
+`)).option(...SHARED_OPTIONS.section).option(...SHARED_OPTIONS.fromFile).option(...SHARED_OPTIONS.featureFrontmatter).option(...SHARED_OPTIONS.prioritySet).option("--ac-numbering <mode>", "Set the ac_numbering frontmatter field (task-local) \u2014 opts the task into the Requirements\u2194AC coverage check").option("--ac-altitude <mode>", "Set the ac_altitude frontmatter field. Valid: `graduating` (default; feature-AC subset rule enforced) or `task-local` (skip the DD-09 subset rule \u2014 task scenarios are intentionally not feature ship criteria). Mirrors the L1 schema enum (packages/domain/src/planning/schema.ts:304).").option("--no-lifecycle", "Suppress lifecycle workflow run creation (use during pipeline runs to avoid orphaned lifecycle runs)").option("--force-done", "Allow transitioning to `done` even when the verify verdict is not PASS; records an override (task 0292). Waives the verdict only \u2014 the FSM path still applies, so from an earlier status walk the hops first: `todo` \u2192 `wip` \u2192 `testing` \u2192 `done` (each hop runs the structural `spur task check`)").option("--reason <text>", "Rationale for a forced-done override (paired with --force-done; persisted as done_reason)").option("--verdict-dir <path>", "Directory holding <wbs>-verdict.json artifacts (default: .spur/run)").option(...SHARED_OPTIONS.folderTasks).option(...SHARED_OPTIONS.json).action(async (wbs, status, options) => {
     const svc = await makeService2(context4, options.folder, options.lifecycle === false);
     try {
       if (options.section !== undefined) {
@@ -103001,7 +104114,7 @@ ${result.content}`);
         let forcedDoneVerdict;
         if (status === "done") {
           const current = await svc.show(wbs);
-          const verdictDir = options.verdictDir ?? join31(context4.cwd, ".spur", "run");
+          const verdictDir = options.verdictDir ?? join33(context4.cwd, ".spur", "run");
           const loaded = await readVerdictArtifact(context4.fs, verdictDir, wbs);
           const guardOutcome = evaluateDoneTransition({
             wbs,
@@ -103083,7 +104196,7 @@ ${result.content}`);
 
 ` + `Validation: WBS format, existence, self-edge, duplicates, and cycle detection
 ` + `all run BEFORE any write (atomic \u2014 R2). Exit codes: 0 success, 1 generic error,
-` + "2 usage error, 3 validation error.").argument("<wbs>", "Task WBS number to mutate").argument("<op>", "Operation: set | add | remove | clear").argument("[values...]", "WBS values (required for set/add/remove; forbidden for clear)").option("--folder <path>", "Custom tasks folder").option("--json", "Output machine-readable JSON").action(async (wbs, op, values, options) => {
+` + "2 usage error, 3 validation error.").argument("<wbs>", "Task WBS number to mutate").argument("<op>", "Operation: set | add | remove | clear").argument("[values...]", "WBS values (required for set/add/remove; forbidden for clear)").option(...SHARED_OPTIONS.folderTasks).option(...SHARED_OPTIONS.json).action(async (wbs, op, values, options) => {
     const allowedOps = ["set", "add", "remove", "clear"];
     if (!allowedOps.includes(op)) {
       context4.output.error(`Unknown op "${op}". Allowed: ${allowedOps.join(", ")}.`);
@@ -103123,7 +104236,7 @@ ${result.content}`);
 ` + `(${UNIVERSAL_SECTIONS.join(", ")}) are always allowed. All writes go through the
 ` + `existing planning-write-service.updateSection pipeline \u2014 phantom-section guards,
 ` + `atomic writes, history, and timestamps are inherited. Exit codes: 0 success,
-` + "1 generic error, 2 usage error, 3 validation error.").argument("<wbs>", "Task WBS number to mutate").argument("<op>", "Operation: init | add | list").argument("[name]", "Canonical section name (required for add; forbidden for init/list)").option("--folder <path>", "Custom tasks folder").option("--json", "Output machine-readable JSON").action(async (wbs, op, name, options) => {
+` + "1 generic error, 2 usage error, 3 validation error.").argument("<wbs>", "Task WBS number to mutate").argument("<op>", "Operation: init | add | list").argument("[name]", "Canonical section name (required for add; forbidden for init/list)").option(...SHARED_OPTIONS.folderTasks).option(...SHARED_OPTIONS.json).action(async (wbs, op, name, options) => {
     const allowedOps = ["init", "add", "list"];
     if (!allowedOps.includes(op)) {
       context4.output.error(`Unknown op "${op}". Allowed: ${allowedOps.join(", ")}.`);
@@ -103170,7 +104283,7 @@ ${result.content}`);
       }
     }
   });
-  task.command("list").summary("List tasks with optional filtering.").option("--status <s>", "Filter by status").option("--phase <p>", "Filter by phase (legacy alias for --status)").option("--parent <wbs>", "Filter by parent WBS").option("--feature <id>", "Filter by linked feature ID (feature_id edge)").option("--folder <path>", "Custom tasks folder").option("--json", "Output machine-readable JSON").action(async (options) => {
+  task.command("list").summary("List tasks with optional filtering.").option(...SHARED_OPTIONS.statusFilter).option("--phase <p>", "Filter by phase (legacy alias for --status)").option("--parent <wbs>", "Filter by parent WBS").option(...SHARED_OPTIONS.featureFilterEdge).option(...SHARED_OPTIONS.folderTasks).option(...SHARED_OPTIONS.json).action(async (options) => {
     const svc = await makeService2(context4, options.folder);
     try {
       const tasks = await svc.list({
@@ -103198,7 +104311,7 @@ ${result.content}`);
       context4.setExitCode(1);
     }
   });
-  task.command("refresh").summary("Re-scan the task corpus and report counts (kanban.md retired \u2014 A17 cutover).").option("--folder <path>", "Custom tasks folder").option("--json", "Output machine-readable JSON").action(async (options) => {
+  task.command("refresh").summary("Re-scan the task corpus and report counts (kanban.md retired \u2014 A17 cutover).").option(...SHARED_OPTIONS.folderTasks).option(...SHARED_OPTIONS.json).action(async (options) => {
     const svc = await makeService2(context4, options.folder);
     try {
       const result = await svc.refresh();
@@ -103212,7 +104325,7 @@ ${result.content}`);
       context4.setExitCode(1);
     }
   });
-  task.command("migrate").summary("Run the one-time A17 task corpus normalization pass.").option("--dry-run", "Produce the full report without writing files").option("--folder <path>", "Custom tasks folder").option("--json", "Output machine-readable JSON").action(async (options) => {
+  task.command("migrate").summary("Run the one-time A17 task corpus normalization pass.").option(...SHARED_OPTIONS.dryRunTaskReport).option(...SHARED_OPTIONS.folderTasks).option(...SHARED_OPTIONS.json).action(async (options) => {
     try {
       const foldersConfig = (await resolvePlanningFolders(context4.fs)).foldersConfig;
       const activeFolder = context4.fs.resolve(foldersConfig.active_folder);
@@ -103230,7 +104343,7 @@ ${result.content}`);
       context4.setExitCode(1);
     }
   });
-  task.command("migrate-anchors").summary("Qualify in-repo evidence anchors to repo-relative paths (0583 R1\u2013R3).").option("--dry-run", "Produce the full report without writing files").option("--json", "Output machine-readable JSON").action(async (options) => {
+  task.command("migrate-anchors").summary("Qualify in-repo evidence anchors to repo-relative paths (0583 R1\u2013R3).").option(...SHARED_OPTIONS.dryRunTaskReport).option(...SHARED_OPTIONS.json).action(async (options) => {
     try {
       const dryRun = options.dryRun === true;
       const report = await anchorQualify(context4.fs, {
@@ -103275,7 +104388,7 @@ ${result.content}`);
       context4.setExitCode(1);
     }
   });
-  task.command("refresh-roster").summary("Regenerate a parent task's sub-task roster block in its ## Plan (0121 roll-up gate's generator).").argument("<wbs>", "Parent task WBS number").option("--folder <path>", "Custom tasks folder").option("--json", "Output machine-readable JSON").action(async (wbs, options) => {
+  task.command("refresh-roster").summary("Regenerate a parent task's sub-task roster block in its ## Plan (0121 roll-up gate's generator).").argument("<wbs>", "Parent task WBS number").option(...SHARED_OPTIONS.folderTasks).option(...SHARED_OPTIONS.json).action(async (wbs, options) => {
     const svc = await makeService2(context4, options.folder);
     try {
       const result = await svc.refreshRoster(wbs);
@@ -103291,7 +104404,7 @@ ${result.content}`);
       context4.setExitCode(1);
     }
   });
-  task.command("batch-create").summary("Create many tasks from a validated JSON file \u2014 all-or-nothing (LLM\u2192CLI gate).").requiredOption("--file <path>", "Path to the batch JSON file validated against task-batch.schema.json").option("--folder <path>", "Custom tasks folder").option("--json", "Output machine-readable JSON").action(async (options) => {
+  task.command("batch-create").summary("Create many tasks from a validated JSON file \u2014 all-or-nothing (LLM\u2192CLI gate).").requiredOption(...SHARED_OPTIONS.fileTaskBatch).option(...SHARED_OPTIONS.folderTasks).option(...SHARED_OPTIONS.json).action(async (options) => {
     const svc = await makeService2(context4, options.folder);
     try {
       const { children, parentsWired } = await svc.batchCreate(options.file);
@@ -103335,7 +104448,7 @@ ${result.content}`);
       }
     }
   });
-  task.command("record").summary("Record pipeline results into the task file \u2014 Testing, Review, and optional Solution backfill.").argument("<wbs>", "Task WBS number").option("--verdict-file <path>", "Path to verdict JSON (default: .spur/run/<wbs>-verdict.json)").option("--solution-from-diff", "Backfill Solution from git diff when bare").option("--transition <status>", "Optional lifecycle transition (e.g. testing)").option("--folder <path>", "Custom tasks folder").option("--json", "Output machine-readable JSON").action(async (wbs, options) => {
+  task.command("record").summary("Record pipeline results into the task file \u2014 Testing, Review, and optional Solution backfill.").argument("<wbs>", "Task WBS number").option("--verdict-file <path>", "Path to verdict JSON (default: .spur/run/<wbs>-verdict.json)").option("--solution-from-diff", "Backfill Solution from git diff when bare").option("--transition <status>", "Optional lifecycle transition (e.g. testing)").option(...SHARED_OPTIONS.folderTasks).option(...SHARED_OPTIONS.json).action(async (wbs, options) => {
     const svc = await makeService2(context4, options.folder);
     try {
       const result = await svc.record(wbs, {
@@ -103362,7 +104475,7 @@ ${result.content}`);
       context4.setExitCode(1);
     }
   });
-  task.command("verdict").summary("Derive PASS/PARTIAL/FAIL/UNKNOWN verdict from verify answer text (replaces pipeline grep/shell).").argument("<wbs>", "Task WBS number").option("--from-answer <path>", "Path to verify answer text file").option("--folder <path>", "Custom tasks folder").option("--json", "Output machine-readable JSON").action(async (wbs, options) => {
+  task.command("verdict").summary("Derive PASS/PARTIAL/FAIL/UNKNOWN verdict from verify answer text (replaces pipeline grep/shell).").argument("<wbs>", "Task WBS number").option("--from-answer <path>", "Path to verify answer text file").option(...SHARED_OPTIONS.folderTasks).option(...SHARED_OPTIONS.json).action(async (wbs, options) => {
     const { deriveVerdict: deriveVerdict2, verdictRowsMatchScenarios: verdictRowsMatchScenarios2 } = await init_src3().then(() => exports_src2);
     const answerPath = options.fromAnswer ?? `.spur/run/${wbs}-verify-answer.txt`;
     let answerText;
@@ -103404,7 +104517,7 @@ ${result.content}`);
       context4.setExitCode(1);
     }
   });
-  task.command("verifyall-aggregate").summary("Aggregate per-task verify outcomes into a deterministic batch verdict (verifyall).").description("Reads a JSON array of per-task outcomes ({wbs,outcome}) and emits the batch " + "verdict with NOT-STARTED tasks excluded from the rollup. Replaces agent-discretion " + "rollup prose (dev-operations.md \xA73a) with deterministic code (task 0341).").option("--from-file <path>", "Path to JSON array of {wbs,outcome[,reason]} rows").option("--json", "Output machine-readable JSON").action(async (options) => {
+  task.command("verifyall-aggregate").summary("Aggregate per-task verify outcomes into a deterministic batch verdict (verifyall).").description("Reads a JSON array of per-task outcomes ({wbs,outcome}) and emits the batch " + "verdict with NOT-STARTED tasks excluded from the rollup. Replaces agent-discretion " + "rollup prose (dev-operations.md \xA73a) with deterministic code (task 0341).").option(...SHARED_OPTIONS.fromFileOutcomeRows).option(...SHARED_OPTIONS.json).action(async (options) => {
     const inputPath = options.fromFile ?? ".spur/run/verifyall-batch-input.json";
     let raw2;
     try {
@@ -103451,7 +104564,7 @@ ${result.content}`);
       context4.setExitCode(1);
     }
   });
-  task.command("check").summary("Validate a task file through the four-layer check (design \xA73).").argument("[wbs]", "Task WBS number (validates all tasks in the folder when omitted)").option("--strict", "Elevate ALL warnings to failures").option("--strict-core", "Compatibility alias (F92 R2): historically the done-gate label; kept so installed plugins/workflows that call it keep working. No longer meaningful on its own \u2014 target-state selection (`--as`) supplies the real done semantics.").option("--as <status>", "Evaluate the task AS if it were in <status> (F92 R2): the lifecycle guards pass the transition target so testing\u2192done checks the done row. Validate against canonical task statuses. Omitted \u2192 current-status diagnostics.").option("--corpus", "Sweep every task and feature against config/corpus-baseline.json").option("--since <ref>", "Scope the corpus fog check to changes since a git ref (requires --corpus)").option("--folder <path>", "Custom tasks folder").option("--json", "Output machine-readable JSON").action(async (wbs, options) => {
+  task.command("check").summary("Validate a task file through the four-layer check (design \xA73).").argument("[wbs]", "Task WBS number (validates all tasks in the folder when omitted)").option(...SHARED_OPTIONS.strictTaskAll).option("--strict-core", "Compatibility alias (F92 R2): historically the done-gate label; kept so installed plugins/workflows that call it keep working. No longer meaningful on its own \u2014 target-state selection (`--as`) supplies the real done semantics.").option(...SHARED_OPTIONS.asTaskF92).option("--corpus", "Sweep every task and feature against config/corpus-baseline.json").option("--since <ref>", "Scope the corpus fog check to changes since a git ref (requires --corpus)").option("--fix", "repair structural findings in place (heading presence/level/order, R-item checkboxes)").option(...SHARED_OPTIONS.folderTasks).option(...SHARED_OPTIONS.json).action(async (wbs, options) => {
     const json3 = options.json === true;
     const strict = options.strict === true;
     const asStatus = options.as === undefined ? undefined : canonicalStatusOrRaw(options.as);
@@ -103465,6 +104578,11 @@ ${result.content}`);
       context4.setExitCode(2);
       return;
     }
+    if (options.fix === true && options.corpus === true) {
+      context4.output.error("--fix repairs files in place and cannot be combined with --corpus");
+      context4.setExitCode(2);
+      return;
+    }
     try {
       if (options.corpus === true) {
         if (wbs !== undefined) {
@@ -103521,6 +104639,11 @@ ${result.content}`);
       const printResult = (result) => {
         if (json3)
           return;
+        if (result.repairs !== undefined && result.repairs.length > 0) {
+          for (const r2 of result.repairs) {
+            context4.output.write(`  [FIX] ${r2.kind} ${r2.section}: ${r2.detail}`);
+          }
+        }
         context4.output.write(`
 ${result.wbs} (${result.status}): ${result.pass ? "PASS" : "FAIL"}`);
         for (const f of result.findings) {
@@ -103543,7 +104666,8 @@ ${result.wbs} (${result.status}): ${result.pass ? "PASS" : "FAIL"}`);
             strict,
             asStatus,
             severityOverrides: planningFolders.severityOverrides,
-            accepted
+            accepted,
+            fix: options.fix === true
           });
           results.push(result);
           printResult(result);
@@ -103562,7 +104686,8 @@ ${result.wbs} (${result.status}): ${result.pass ? "PASS" : "FAIL"}`);
             strict,
             asStatus,
             severityOverrides: planningFolders.severityOverrides,
-            accepted
+            accepted,
+            fix: options.fix === true
           });
           results.push(result);
           printResult(result);
@@ -103596,7 +104721,7 @@ ${result.wbs} (${result.status}): ${result.pass ? "PASS" : "FAIL"}`);
       context4.setExitCode(1);
     }
   });
-  task.command("resolve").summary("Resolve a file path to its owning task WBS.").argument("<file-path>", "File path to resolve").option("--folder <path>", "Custom tasks folder").option("--strict", "Match only the exact corpus path (no basename-WBS fallback)").option("--json", "Output machine-readable JSON").action(async (filePath, options) => {
+  task.command("resolve").summary("Resolve a file path to its owning task WBS.").argument("<file-path>", "File path to resolve").option(...SHARED_OPTIONS.folderTasks).option(...SHARED_OPTIONS.strictTaskPath).option(...SHARED_OPTIONS.json).action(async (filePath, options) => {
     const svc = await makeService2(context4, options.folder);
     try {
       const result = await svc.resolve(filePath, { strict: options.strict === true });
@@ -103615,7 +104740,7 @@ ${result.wbs} (${result.status}): ${result.pass ? "PASS" : "FAIL"}`);
       context4.setExitCode(1);
     }
   });
-  task.command("path").summary("Resolve a WBS to its absolute task file path.").argument("<wbs>", "Task WBS number").option("--folder <path>", "Custom tasks folder").option("--json", "Output machine-readable JSON").action(async (wbs, options) => {
+  task.command("path").summary("Resolve a WBS to its absolute task file path.").argument("<wbs>", "Task WBS number").option(...SHARED_OPTIONS.folderTasks).option(...SHARED_OPTIONS.json).action(async (wbs, options) => {
     const svc = await makeService2(context4, options.folder);
     try {
       const filePath = await svc.getFilePath(wbs);
@@ -103634,7 +104759,7 @@ ${result.wbs} (${result.status}): ${result.pass ? "PASS" : "FAIL"}`);
       context4.setExitCode(1);
     }
   });
-  task.command("run-link").summary("Record a pipeline provenance link for a task (used by --next auto chains to satisfy testing\u2192done guard).").argument("<wbs>", "Task WBS number").option("--source <source>", "Link source identifier (e.g. next-auto)", "chain").option("--run-id <id>", "Explicit run_id (auto-generated when omitted)").option("--json", "Output machine-readable JSON").action(async (wbs, options) => {
+  task.command("run-link").summary("Record a pipeline provenance link for a task (used by --next auto chains to satisfy testing\u2192done guard).").argument("<wbs>", "Task WBS number").option(...SHARED_OPTIONS.sourceLink, "chain").option(...SHARED_OPTIONS.runIdTask).option(...SHARED_OPTIONS.json).action(async (wbs, options) => {
     try {
       const db2 = await context4.getDb();
       const ensured = await ensurePipelineRunLink(db2, wbs, {
@@ -103659,7 +104784,7 @@ ${result.wbs} (${result.status}): ${result.pass ? "PASS" : "FAIL"}`);
       context4.setExitCode(1);
     }
   });
-  task.command("scaffold-tests").summary("Generate BDD test stubs from task Acceptance Criteria.").argument("<wbs>", "Task WBS number").option("--file <path>", "Custom target test file path").option("--folder <path>", "Custom tasks folder").option("--json", "Output machine-readable JSON").action(async (wbs, options) => {
+  task.command("scaffold-tests").summary("Generate BDD test stubs from task Acceptance Criteria.").argument("<wbs>", "Task WBS number").option(...SHARED_OPTIONS.fileTaskTest).option(...SHARED_OPTIONS.folderTasks).option(...SHARED_OPTIONS.json).action(async (wbs, options) => {
     const { TaskScaffoldService: TaskScaffoldService2, resolvePlanningFolders: resolvePlanningFolders2 } = await init_src3().then(() => exports_src2);
     const foldersConfig = (await resolvePlanningFolders2(context4.fs)).foldersConfig;
     const tasksDir = options.folder ?? context4.fs.resolve(foldersConfig.active_folder);
@@ -103711,15 +104836,15 @@ function loadTemplateBodies(projectRoot, variant) {
   if (cached2 !== undefined)
     return cached2;
   let bodies = {};
-  const localPath = join31(projectRoot, ".spur", "tasks", "templates", `${variant}.md`);
-  if (existsSync11(localPath)) {
-    bodies = extractTemplateBodies(readFileSync10(localPath, "utf8"));
+  const localPath = join33(projectRoot, ".spur", "tasks", "templates", `${variant}.md`);
+  if (existsSync13(localPath)) {
+    bodies = extractTemplateBodies(readFileSync12(localPath, "utf8"));
   } else {
     const root = bundledConfigRoot();
     if (root !== null) {
-      const templatePath = join31(root, "templates", "task", `${variant}.md`);
-      if (existsSync11(templatePath)) {
-        bodies = extractTemplateBodies(readFileSync10(templatePath, "utf8"));
+      const templatePath = join33(root, "templates", "task", `${variant}.md`);
+      if (existsSync13(templatePath)) {
+        bodies = extractTemplateBodies(readFileSync12(templatePath, "utf8"));
       }
     }
   }
@@ -103777,7 +104902,7 @@ async function loadSectionMatrixUncached(projectRoot) {
   }
   const root = bundledConfigRoot();
   if (root !== null) {
-    const matrixPath = join31(root, "tasks", "section-matrix.yaml");
+    const matrixPath = join33(root, "tasks", "section-matrix.yaml");
     if (await fs3.exists(matrixPath)) {
       const data = await loadStructuredSpurConfig(matrixPath, {
         validateJsonSchema: true,
@@ -103788,7 +104913,7 @@ async function loadSectionMatrixUncached(projectRoot) {
   }
   throw new Error(`no canonical section-matrix found for task section authority (F92 R1); tried:
 ` + `  - ${localPath}
-` + (root !== null ? `  - ${join31(root, "tasks", "section-matrix.yaml")}
+` + (root !== null ? `  - ${join33(root, "tasks", "section-matrix.yaml")}
 ` : "") + "copy/generate section-matrix.yaml from the canonical build-time matrix asset (repo `config` `tasks` tree) into one of those paths");
 }
 
@@ -103807,23 +104932,23 @@ function registerTeamCommand(program2, context4) {
     const code = await runTeamAssign(taskId, agentId, context4);
     context4.setExitCode(code);
   });
-  noun.command("status").description("List agent specs and their run status; --by-team groups by team (0258 R4).").option("--json", "Output machine-readable JSON").option("--by-team", "Group specs by their agent.team.<id> membership").option("--server <url>", "Server API URL for live run status", DEFAULT_SERVER).action(async (options) => {
+  noun.command("status").description("List agent specs and their run status; --by-team groups by team (0258 R4).").option(...SHARED_OPTIONS.json).option("--by-team", "Group specs by their agent.team.<id> membership").option("--server <url>", "Server API URL for live run status", DEFAULT_SERVER).action(async (options) => {
     const code = options.byTeam ? await runTeamStatusGrouped(options, context4) : await runTeamStatus(options, context4);
     context4.setExitCode(code);
   });
-  noun.command("up").description("Materialize a team roster into agent specs; best-effort start when spur serve is reachable.").argument("<team>", "Team id (agent.team.<team>)").option("--check", "Dry-run: show the add/prune diff without writing").option("--server <url>", "Server API URL", DEFAULT_SERVER).option("--json", "Output machine-readable JSON").action(async (team, options) => {
+  noun.command("up").description("Materialize a team roster into agent specs; best-effort start when spur serve is reachable.").argument("<team>", "Team id (agent.team.<team>)").option("--check", "Dry-run: show the add/prune diff without writing").option("--server <url>", "Server API URL", DEFAULT_SERVER).option(...SHARED_OPTIONS.json).action(async (team, options) => {
     const code = await runTeamUp(team, options, context4);
     context4.setExitCode(code);
   });
-  noun.command("down").description("Tear down a team: stop members; --purge also removes generated specs.").argument("<team>", "Team id").option("--purge", "Also delete spur:generated specs (never manual / ref:)").option("--server <url>", "Server API URL", DEFAULT_SERVER).option("--json", "Output machine-readable JSON").action(async (team, options) => {
+  noun.command("down").description("Tear down a team: stop members; --purge also removes generated specs.").argument("<team>", "Team id").option("--purge", "Also delete spur:generated specs (never manual / ref:)").option("--server <url>", "Server API URL", DEFAULT_SERVER).option(...SHARED_OPTIONS.json).action(async (team, options) => {
     const code = await runTeamDown(team, options, context4);
     context4.setExitCode(code);
   });
-  noun.command("start").description("Start a supervised agent process (requires spur serve).").argument("<agent-id>", "Agent spec id").option("--server <url>", "Server API URL", DEFAULT_SERVER).option("--json", "Output machine-readable JSON").action(async (agentId, options) => {
+  noun.command("start").description("Start a supervised agent process (requires spur serve).").argument("<agent-id>", "Agent spec id").option("--server <url>", "Server API URL", DEFAULT_SERVER).option(...SHARED_OPTIONS.json).action(async (agentId, options) => {
     const code = await runTeamStart(agentId, options, context4);
     context4.setExitCode(code);
   });
-  noun.command("stop").description("Stop a supervised agent process (requires spur serve).").argument("<agent-id>", "Agent spec id").option("--server <url>", "Server API URL", DEFAULT_SERVER).option("--json", "Output machine-readable JSON").action(async (agentId, options) => {
+  noun.command("stop").description("Stop a supervised agent process (requires spur serve).").argument("<agent-id>", "Agent spec id").option("--server <url>", "Server API URL", DEFAULT_SERVER).option(...SHARED_OPTIONS.json).action(async (agentId, options) => {
     const code = await runTeamStop(agentId, options, context4);
     context4.setExitCode(code);
   });
@@ -104062,9 +105187,88 @@ init_dist6();
 init_dist5();
 await init_src3();
 import { closeSync as closeSync5, fstatSync as fstatSync3, openSync as openSync5, readSync as readSync3 } from "fs";
-import { join as join32, resolve as resolve19 } from "path";
+import { join as join34, resolve as resolve19 } from "path";
 import { createInterface } from "readline";
 import { setTimeout as sleep5 } from "timers/promises";
+
+// src/workflow/mermaid-render.ts
+function esc2(text4) {
+  return text4.replace(/"/g, "&quot;").replace(/\[/g, "&#91;").replace(/\]/g, "&#93;");
+}
+function classLine(id, cls) {
+  return `    class ${esc2(id)} ${cls};`;
+}
+function renderWorkflowMermaid(def) {
+  const lines = [];
+  lines.push("```mermaid");
+  lines.push("flowchart LR");
+  lines.push("    classDef terminal fill:#d4edda,stroke:#1e7e34,color:#0a3d1f;");
+  lines.push("    classDef failure fill:#f8d7da,stroke:#c62828,color:#5f1414;");
+  lines.push("    classDef initial fill:#fff3cd,stroke:#b8860b,color:#5a4a00;");
+  lines.push("    classDef gate fill:#e8e8f8,stroke:#5b5bd6,color:#1a1a5e;");
+  lines.push("    classDef decision fill:#ffe9d1,stroke:#e07b00,color:#6b3a00;");
+  lines.push("    classDef parallel fill:#f0f4f8,stroke:#2c7fb8,color:#123a55;");
+  if (def.kind === "transition-flow") {
+    const terminal = new Set(def.terminalNodes ?? []);
+    const typeShape = {
+      gate: '{{"',
+      decision: '{"',
+      parallel: '[("'
+    };
+    for (const node of def.nodes) {
+      const id = node.id;
+      const type = node.type ?? "action";
+      const terminalNode = terminal.has(id);
+      if (terminalNode) {
+        lines.push(`    ${esc2(id)}(["${esc2(id)}"])`);
+        lines.push(classLine(id, "terminal"));
+      } else if (type === "action") {
+        lines.push(`    ${esc2(id)}["${esc2(id)}"]`);
+      } else {
+        const open = typeShape[type] ?? '["';
+        lines.push(`    ${esc2(id)}${open}${esc2(id)}"]`);
+        const cls = type === "gate" ? "gate" : type === "decision" ? "decision" : "parallel";
+        lines.push(classLine(id, cls));
+      }
+    }
+    lines.push(classLine(def.initialNode, "initial"));
+    for (const edge of def.edges) {
+      const label = [edge.condition !== undefined ? `cond:${edge.condition.kind}` : undefined, edge.description].filter((s3) => s3 !== undefined).join(" \xB7 ");
+      lines.push(label.length > 0 ? `    ${esc2(edge.from)} -->|${esc2(label)}| ${esc2(edge.to)}` : `    ${esc2(edge.from)} --> ${esc2(edge.to)}`);
+    }
+  } else {
+    const terminal = new Set(def.terminalStates ?? []);
+    const failure = new Set(def.failureStates ?? []);
+    for (const state of def.states) {
+      const id = state.id;
+      const isTerminal = terminal.has(id);
+      const isFailure = failure.has(id);
+      if (isFailure) {
+        lines.push(`    ${esc2(id)}["${esc2(id)}"]`);
+        lines.push(classLine(id, "failure"));
+      } else if (isTerminal) {
+        lines.push(`    ${esc2(id)}(["${esc2(id)}"])`);
+        lines.push(classLine(id, "terminal"));
+      } else {
+        lines.push(`    ${esc2(id)}["${esc2(id)}"]`);
+      }
+    }
+    lines.push(classLine(def.initialState, "initial"));
+    for (const t of def.transitions) {
+      const label = [
+        t.trigger !== undefined ? `trigger:${t.trigger}` : undefined,
+        t.guard !== undefined ? `guard:${t.guard.kind}` : undefined,
+        t.description
+      ].filter((s3) => s3 !== undefined).join(" \xB7 ");
+      lines.push(label.length > 0 ? `    ${esc2(t.from)} -->|${esc2(label)}| ${esc2(t.to)}` : `    ${esc2(t.from)} --> ${esc2(t.to)}`);
+    }
+  }
+  lines.push("```");
+  return lines.join(`
+`);
+}
+
+// src/commands/workflow.ts
 function shQuote2(value2) {
   return `'${value2.replace(/'/g, `'\\''`)}'`;
 }
@@ -104160,12 +105364,22 @@ function registerWorkflowCommand(program2, context4) {
     } : {}
   });
   const workflow = program2.command("workflow").summary("validate and execute workflow YAML files");
-  workflow.command("validate").description("Validate a workflow definition.").argument("<file>", "Workflow YAML file").option("--no-schema", "Skip schema validation").option("--json", "Output machine-readable JSON where supported").action(async (file2, options) => {
+  workflow.command("validate").description("Validate a workflow definition.").argument("<file>", "Workflow YAML file").option(...SHARED_OPTIONS.noSchema).option(...SHARED_OPTIONS.jsonSupported).action(async (file2, options) => {
     const result = await makeSvc().validate(file2, { validateSchema: options.schema });
     if (options.json) {
       context4.output.write(toJson2(result));
     } else if (result.valid) {
       context4.output.write(`workflow valid: ${result.workflow.name}`);
+      const c3 = result.composition;
+      if (c3 && (c3.findings.length > 0 || c3.suppressed > 0)) {
+        for (const f of c3.findings) {
+          const m = f.measure.kind === "shell-lines" ? `${f.measure.measured} shell lines (threshold ${f.measure.threshold})` : `${f.measure.measured} prompt chars (severity ${f.measure.severity})`;
+          context4.output.error(`composition advisory: ${f.actionKey} \u2014 ${m} \u2014 ${f.recommendation}`);
+        }
+        if (c3.suppressed > 0) {
+          context4.output.error(`composition advisory: ${c3.suppressed} shell finding(s) suppressed by baseline dispositions (guards excluded wholesale; docs/design/workflow-shell-ownership.md)`);
+        }
+      }
     } else {
       context4.output.error(`workflow invalid: ${result.file}
 ${result.errors.map((m) => `  - ${m}`).join(`
@@ -104173,7 +105387,7 @@ ${result.errors.map((m) => `  - ${m}`).join(`
     }
     context4.setExitCode(result.valid ? 0 : 1);
   });
-  workflow.command("run").description("Execute a workflow definition.").argument("<file>", "Workflow YAML file").option("--run-id <id>", "Persisted run id for workflow run").option("--vars <json>", `Per-run variable overrides as a JSON object, e.g. '{"taskId":"0042"}'`).option("--dry-run", "Validate and walk transitions without executing actions").option("--async", "Start the workflow in the background and exit immediately \u2014 monitor with `spur workflow trace <run-id>`").option("--no-plan", "Suppress the run-start plan preview (synchronous runs only)").option("--quiet", "Suppress plan and per-step progress; keep the final summary").option("--silent", "Suppress all routine output; errors still set a non-zero exit status").option("--verbose", "Include transitions and correlation diagnostics in human progress").option("--detail <level>", "Human detail level: minimal, invocation, or full").option("--trace-file", "Append a redacted schema-versioned JSONL trace under .spur/runs/workflow/").option("--no-log", "Opt out of writing the consolidated .spur/run/<RUNID>.log").option("--steer", "Accept local in-process steering commands on stdin at declared action boundaries").option("--json", "Output machine-readable JSON where supported").action(async (file2, options) => {
+  workflow.command("run").description("Execute a workflow definition.").argument("<file>", "Workflow YAML file").option(...SHARED_OPTIONS.runIdWorkflow).option("--vars <json>", `Per-run variable overrides as a JSON object, e.g. '{"taskId":"0042"}'`).option(...SHARED_OPTIONS.dryRunWorkflowValidate).option("--async", "Start the workflow in the background and exit immediately \u2014 monitor with `spur workflow trace <run-id>`").option("--no-plan", "Suppress the run-start plan preview (synchronous runs only)").option("--quiet", "Suppress plan and per-step progress; keep the final summary").option("--silent", "Suppress all routine output; errors still set a non-zero exit status").option(...SHARED_OPTIONS.verboseWorkflow).option("--detail <level>", "Human detail level: minimal, invocation, or full").option("--trace-file", "Append a redacted schema-versioned JSONL trace under .spur/runs/workflow/").option("--no-log", "Opt out of writing the consolidated .spur/run/<RUNID>.log").option("--steer", "Accept local in-process steering commands on stdin at declared action boundaries").option(...SHARED_OPTIONS.jsonSupported).action(async (file2, options) => {
     const json3 = options.json === true;
     const silent = !json3 && options.silent === true;
     const quiet = !json3 && options.quiet === true;
@@ -104289,7 +105503,7 @@ Monitor with: spur workflow trace ${runId2} --follow`);
     }
     const runLog = options.log === false ? undefined : new WorkflowRunLogSink({
       bus,
-      dir: join32(context4.cwd, ".spur", "run"),
+      dir: join34(context4.cwd, ".spur", "run"),
       runId,
       ...planPreview !== undefined ? { planPreview } : {},
       ...await resolveOutputLogConfig(context4.cwd)
@@ -104386,7 +105600,7 @@ Monitor with: spur workflow trace ${runId2} --follow`);
     context4.setExitCode(result.status === "done" ? 0 : 1);
     await maybeTriggerHistoryRefresh(context4, "pipeline-run", runId);
   });
-  workflow.command("continue").description("Resume a paused (HITL) workflow run. Omit run-id to resume the most recent paused run.").argument("[run-id]", "Run ID to resume (default: the most recent paused run)").option("--yes", "Skip the CLI resume confirmation (does not set the persisted HITL answer)").option("--answer <yes|no|cancel>", "Inject a HITL gate answer before guard re-evaluation (0433). Does not imply --yes.").option("--json", "Output machine-readable JSON where supported").action(async (runId, options) => {
+  workflow.command("continue").description("Resume a paused (HITL) workflow run. Omit run-id to resume the most recent paused run.").argument("[run-id]", "Run ID to resume (default: the most recent paused run)").option("--yes", "Skip the CLI resume confirmation (does not set the persisted HITL answer)").option("--answer <yes|no|cancel>", "Inject a HITL gate answer before guard re-evaluation (0433). Does not imply --yes.").option(...SHARED_OPTIONS.jsonSupported).action(async (runId, options) => {
     const json3 = options.json === true;
     let hitlAnswer;
     if (options.answer !== undefined) {
@@ -104439,7 +105653,7 @@ Monitor with: spur workflow trace ${runId2} --follow`);
       ledger.unsubscribe();
     }
   });
-  workflow.command("clean").description("Housekeeping: finalize orphaned runs stuck in running/pending past a staleness threshold " + "(mark as failed) and reclaim retained run logs older than workflow.logRetentionDays. " + "`--logs` scopes to log reclamation only. To cancel a single live run by id, use " + "`spur workflow cancel <run-id>` instead.").option("--older-than <minutes>", "Staleness threshold in minutes (stale-run scope only)", "30").option("--force", "Clean ALL non-terminal runs regardless of age (overrides --older-than)").option("--logs", "Scope to retained run-log reclamation only (skip stale-run finalization)").option("--dry-run", "List what would be cleaned without writing (applies to both scopes)").option("--json", "Output machine-readable JSON where supported").action(async (options) => {
+  workflow.command("clean").description("Housekeeping: finalize orphaned runs stuck in running/pending past a staleness threshold " + "(mark as failed) and reclaim retained run logs older than workflow.logRetentionDays. " + "`--logs` scopes to log reclamation only. To cancel a single live run by id, use " + "`spur workflow cancel <run-id>` instead.").option("--older-than <minutes>", "Staleness threshold in minutes (stale-run scope only)", "30").option(...SHARED_OPTIONS.forceWorkflowClean).option("--logs", "Scope to retained run-log reclamation only (skip stale-run finalization)").option(...SHARED_OPTIONS.dryRunWorkflowClean).option(...SHARED_OPTIONS.jsonSupported).action(async (options) => {
     const dryRun = options.dryRun === true;
     const logsOnly = options.logs === true;
     const force = options.force === true;
@@ -104481,7 +105695,7 @@ Monitor with: spur workflow trace ${runId2} --follow`);
       }
     }
   });
-  workflow.command("cancel").description("Cancel a single non-terminal run by id (mark as failed). The bulk/stale variant is `spur workflow clean`.").argument("<run-id>", "Run id to cancel").option("--json", "Output machine-readable JSON where supported").action(async (runId, options) => {
+  workflow.command("cancel").description("Cancel a single non-terminal run by id (mark as failed). The bulk/stale variant is `spur workflow clean`.").argument("<run-id>", "Run id to cancel").option(...SHARED_OPTIONS.jsonSupported).action(async (runId, options) => {
     const result = await makeSvc(options.json).cancel(runId);
     if (options.json) {
       context4.output.write(toJson2(result));
@@ -104499,7 +105713,7 @@ Monitor with: spur workflow trace ${runId2} --follow`);
       context4.output.write(`Run ${runId} already terminal (${result.status}) \u2014 no change.`);
     }
   });
-  workflow.command("list").description("List available workflow YAML files.").option("--json", "Output machine-readable JSON where supported").action(async (options) => {
+  workflow.command("list").description("List available workflow YAML files.").option(...SHARED_OPTIONS.jsonSupported).action(async (options) => {
     const paths = await resolveWorkflowPaths(context4.cwd);
     const result = await makeSvc().list(paths);
     if (options.json) {
@@ -104508,7 +105722,19 @@ Monitor with: spur workflow trace ${runId2} --follow`);
       context4.output.write(formatListHuman(result));
     }
   });
-  workflow.command("trace").description("Show persisted workflow run history.").argument("[run-id]", "Run ID for per-run timeline detail").option("--workflow <name>", "Filter by workflow name").option("--status <status>", "Filter by status: done, failed, running").option("--since <iso-date>", "Filter runs started on or after this date").option("--last <n>", "Limit results (default 20)", "20").option("--follow", "Replay a run timeline and poll persisted state until it becomes terminal").option("--poll <ms>", "Follow polling interval in milliseconds", "1000").option("--output", "With --follow: stream .spur/run/<RUNID>.log instead of the DB timeline").option("--json", "Output machine-readable JSON where supported").action(async (runId, options) => {
+  workflow.command("show").description("Render a workflow definition as a mermaid FSM diagram.").argument("<file>", "Workflow YAML file").action(async (file2) => {
+    const filePath = resolve19(context4.cwd, file2);
+    let def;
+    try {
+      def = await loadWorkflowDef(filePath, { validateSchema: true });
+    } catch (err) {
+      context4.output.error(`workflow show: cannot read or parse ${file2} \u2014 ${err instanceof Error ? err.message : String(err)}`);
+      context4.setExitCode(1);
+      return;
+    }
+    context4.output.write(renderWorkflowMermaid(def));
+  });
+  workflow.command("trace").description("Show persisted workflow run history.").argument("[run-id]", "Run ID for per-run timeline detail").option("--workflow <name>", "Filter by workflow name").option(...SHARED_OPTIONS.statusDoneFailedRunning).option(...SHARED_OPTIONS.since).option(...SHARED_OPTIONS.last, "20").option("--follow", "Replay a run timeline and poll persisted state until it becomes terminal").option(...SHARED_OPTIONS.pollWorkflow, "1000").option("--output", "With --follow: stream .spur/run/<RUNID>.log instead of the DB timeline").option(...SHARED_OPTIONS.jsonSupported).action(async (runId, options) => {
     const svc = makeSvc();
     const last = parseInt(options.last, 10);
     if (Number.isNaN(last) || last < 1) {
@@ -104619,18 +105845,18 @@ function formatTraceList2(result) {
 `);
 }
 function formatTraceTimeline(result) {
-  const { run, events: events2 } = result;
-  const dryLabel = run.isDryRun ? " [DRY RUN]" : "";
-  const reasonLabel = run.failureReason ? ` \u2014 ${run.failureReason}` : "";
+  const { run: run2, events: events2 } = result;
+  const dryLabel = run2.isDryRun ? " [DRY RUN]" : "";
+  const reasonLabel = run2.failureReason ? ` \u2014 ${run2.failureReason}` : "";
   const lines = [
-    `Run: ${run.runId} \u2014 ${run.workflowName} (${run.mode}) \u2014 ${run.status}${dryLabel}${reasonLabel}`,
-    `Project: ${run.project.name} (${run.project.root})`,
-    `Started: ${run.startedAt}   Completed: ${run.completedAt ?? "unavailable"}   Duration: ${run.durationMs === null ? "unavailable" : `${run.durationMs}ms`}`,
-    `Outcome: ${run.outcome}   Events: ${events2.length}`,
+    `Run: ${run2.runId} \u2014 ${run2.workflowName} (${run2.mode}) \u2014 ${run2.status}${dryLabel}${reasonLabel}`,
+    `Project: ${run2.project.name} (${run2.project.root})`,
+    `Started: ${run2.startedAt}   Completed: ${run2.completedAt ?? "unavailable"}   Duration: ${run2.durationMs === null ? "unavailable" : `${run2.durationMs}ms`}`,
+    `Outcome: ${run2.outcome}   Events: ${events2.length}`,
     ""
   ];
-  if (run.nextAction !== undefined)
-    lines.splice(4, 0, `Next: ${run.nextAction.label} \u2014 ${run.nextAction.value}`);
+  if (run2.nextAction !== undefined)
+    lines.splice(4, 0, `Next: ${run2.nextAction.label} \u2014 ${run2.nextAction.value}`);
   if (result.outputArtifact !== undefined) {
     lines.push(`Run log: ${result.outputArtifact} (tail -f for live view)`);
     lines.push("");
@@ -104748,7 +105974,7 @@ function readRunLogChunk(logPath, offset) {
   }
 }
 async function followRunLog(service, runId, dir, pollMs, write, wait = (ms) => sleep5(ms)) {
-  const logPath = join32(dir, ".spur", "run", `${runId}.log`);
+  const logPath = join34(dir, ".spur", "run", `${runId}.log`);
   let offset = 0;
   let everRead = false;
   while (true) {
@@ -104811,7 +106037,7 @@ init_src();
 init_src2();
 init_dist5();
 await init_src3();
-import { dirname as dirname22, join as join33, resolve as resolve20 } from "path";
+import { dirname as dirname22, join as join35, resolve as resolve20 } from "path";
 import { isatty as isatty4 } from "tty";
 
 // ../../node_modules/.bun/@clack+core@1.4.1/node_modules/@clack/core/dist/index.mjs
@@ -106269,7 +107495,7 @@ function createCliContext(options) {
 function noopSetExitCode(_code) {}
 async function createMigratedDbAdapter(cwd = process.cwd(), env = process.env, dbUrl) {
   const config4 = buildConfigFromEnv(env);
-  const configuredUrl = env.DATABASE_URL === undefined ? join33(cwd, DEFAULT_DATABASE_URL) : config4.database.url;
+  const configuredUrl = env.DATABASE_URL === undefined ? join35(cwd, DEFAULT_DATABASE_URL) : config4.database.url;
   const url2 = dbUrl ?? configuredUrl;
   if (url2 !== IN_MEMORY_DATABASE_URL) {
     await createNodeFileSystem3().ensureDir(dirname22(url2));
@@ -106329,15 +107555,21 @@ async function runCommandDispatch(argv, context4, output2) {
   });
   program2.option("-v, --cli-verbose", "Show internal diagnostics");
   registerAgentCommand(program2, context4);
+  registerBuilderCommand(program2, context4);
   registerFeatureCommand(program2, context4);
   registerHistoryCommand(program2, context4);
-  registerInitCommand(program2, context4);
   registerMessageCommand(program2, context4);
-  registerMigrateCommand(program2, context4);
   registerProjectsCommand(program2, context4);
   registerRuleCommand(program2, context4);
-  registerStatusCommand(program2, context4);
-  registerServeCommand(program2, context4);
+  const selfCommand = program2.command("self").summary("inspect and manage the Spur installation itself");
+  registerInitCommand(selfCommand, context4);
+  registerMigrateCommand(selfCommand, context4);
+  registerServeCommand(selfCommand, context4);
+  registerStatusCommand(selfCommand, context4);
+  registerInitCommand(program2, context4, { hidden: true });
+  registerMigrateCommand(program2, context4, { hidden: true });
+  registerServeCommand(program2, context4, { hidden: true });
+  registerStatusCommand(program2, context4, { hidden: true });
   registerTeamCommand(program2, context4);
   registerTaskCommand(program2, context4);
   registerWorkflowCommand(program2, context4);